docs(spec,cli): re-measure the two better-auth stamps the 1.7.12 lift falsified

The organization schema's updatedAt TSDoc keeps its 1.7.3 reading and
appends the 1.7.12 re-measurement (the organization plugin schema is
byte-identical; transformOutput still projects declared fields only).
The os migrate account-issuer description names the restored key and
no version, so no later lift can falsify it. spec and cli ride the
existing changeset as patch, text only.

Claude-Session: https://claude.ai/code/session_011TdZ8GjixNZFLz1xJD9zzK
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/25096-better-auth-1-7-12.md

@@ -1,5 +1,7 @@
 ---
 '@objectstack/plugin-auth': minor
+'@objectstack/spec': patch
+'@objectstack/cli': patch
 ---
 
 fix(plugin-auth)!: lift the better-auth family from 1.7.3 to 1.7.12 for the security fixes published since
@@ -28,4 +30,5 @@ Clause-②: no (narrowing)
   **TO:** the same `401` also clears the stale session cookies.
 - **New route:** `POST /api/v1/auth/oauth2/client/rotate-keys` (`private_key_jwt` key rotation) is now published, and refused with `403 access_denied` because this package does not enable client key rotation.
 - **Unchanged:** the package's exports and configuration; sign-up, sign-in and session cookies (`HttpOnly; SameSite=Lax; Path=/`, no `Secure` on plain HTTP); the active organization stamped on a new session; implicit account linking and its unlink records; single-use reservations (a replayed DPoP proof or client assertion is still refused); and where sessions and verification values are stored with or without a host `secondaryStorage`.
+- **`@objectstack/spec` and `@objectstack/cli` (patch, text only, not breaking):** the TSDoc on the organization schema's optional `updatedAt` now records that its better-auth measurement still holds on 1.7.12, and the `os migrate account-issuer` description no longer names a better-auth version. No schema, type, flag or behaviour changes in either package.
 - **What to do as an operator:** tell users that a Magic Link, social, SSO or account-linking sign-in begun before the upgrade must be started again after it. Check each OIDC SSO provider's configured issuer against its discovery document and set it to the exact `issuer` string the document publishes. An OAuth client that branched on `401` for a PKCE failure should branch on `400 invalid_grant`. A browser client that read every non-`200` `/get-session` answer as "signed out" should treat a `500` as "try again".

packages/cli/src/commands/migrate/account-issuer.ts

@@ -68,7 +68,7 @@ export default class MigrateAccountIssuer extends Command {
   static override description =
     'Pre-flight the retirement of sys_account.issuer: report every (provider_id, account_id) ' +
     'key held by more than one row — the class that is legal under the retired (issuer, account_id) key ' +
-    'and is ONE account under the key better-auth 1.7.3 restored. Read-only; exits non-zero when the ' +
+    'and is ONE account under the (provider_id, account_id) key better-auth restored. Read-only; exits non-zero when the ' +
     'drop must not proceed.';
 
   static override examples = [

packages/spec/src/identity/organization.zod.ts

@@ -92,7 +92,9 @@ export const OrganizationSchema = lazySchema(() => z.object({
    * produced by better-auth's own serializer and its documented shape carries
    * no `updatedAt`, then for those routes the spec aligns to the documented
    * wire (`updatedAt` optional there)」. Both halves measured against the
-   * installed better-auth 1.7.3, so fallback A applies:
+   * installed better-auth 1.7.3 (re-measured on 1.7.12 for #25096: the
+   * organization plugin schema is byte-identical and `transformOutput` still
+   * projects declared fields only), so fallback A applies:
    *
    *  - **The serializer is the vendor's.** The `organization/*` routes are
    *    better-auth's own endpoints, mounted through plugin-auth's single