Email/password, Google, and enterprise SSO all run through Better Auth's Expo client — the session cookie lives in
expo-secure-store and OAuth returns through the classroomio:// deep link. Multi-org accounts
pick an organization, which sets the cio-org-id header for every later request and re-themes the app.
Self-hosted installs point the same binary at their own API and skip the picker.
cio-org-id and re-themes the app; single-org and self-hosted users never see it.