[theogravity]

Upgrade Better Auth, its API-key and passkey plugins from 1.7.1 to 1.7.14, and align JOSE at 6.2.13 across its consumers.

Better Auth no longer writes the required account issuer column introduced in 1.7.1. Migration 0069 removes that constraint and encodes each OAuth issuer and subject together, preserving identity separation when an administrator changes or recreates a provider. Password credentials, account ownership, tokens, and sessions are preserved. Ambiguous account keys stop migration before writes; downgrading requires a pre-upgrade backup.

Update direct account writes, backup migration compatibility, fixtures, security documentation, and the release changeset.

CI also detected newly reviewed GHSA-gcqx-w48m-w2h4 in Expo's existing deepmerge 4.3.1 dependency. No fixed release is published. Patch source and both distributed bundles to reject proto in both copy loops. The Node regression against Expo's resolved dependency fails without the patch and passes with it, including normal merge compatibility. Record the patch-backed audit exception until an upstream fixed release is available. Regression coverage checks migrated OAuth ownership, synthetic issuers, duplicate keys, and issuer replacement; removing issuer separation makes the new sign-in regression fail.

Validation:

• Affected package suites: 9,838 passed, two skipped before review fixes; final server suite: 4,832 passed.
• Final authentication/backup browser scenarios: eight passed.
• Broader browser suite: 87 passed, five skipped; the preview scenario hit existing host listeners on ports 4123/9423, then passed using unused ports in a temporary test copy.
• Builds, type checks, lint, dependency/lockfile/license checks, frozen installation, and compiled server/node setup and enrollment passed.
• Patched dependency validation: 337 repository-script tests passed (three platform skips), dependency audit passed, and Expo Android bundle export passed.