Retire the @better-auth/oauth-provider pnpm patch once upstream ships the redirect fixes

[zachdunn]

Context

PRs #885–#887 worked around two upstream Better Auth 1.7.x bugs to unblock MCP clients (opencode, Cursor):

• oauth-provider: inverted condition rejects all loopback redirect URIs for web clients better-auth/better-auth#10913 — web-client redirect check rejects all loopback redirect URIs (inverted condition; our workaround: default/coerce application_type to native in the /oauth2/register before-hook, apps/auth/src/cimd-transport.ts).
• OAuth provider rejects Cursor's host-bearing cursor:// redirect URI better-auth/better-auth#10946 (fix PR fix(oauth-provider): accept host-bearing custom-scheme native redirects better-auth/better-auth#10956, unmerged) — native validator rejects host-bearing custom-scheme redirects like cursor://anysphere.cursor-mcp/oauth/callback. Our workaround: patches/@better-auth__oauth-provider.patch (registered in pnpm-workspace.yaml patchedDependencies) porting #10956 into the bundled dist.

When upstream releases include these fixes

1. Bump @better-auth/oauth-provider (and siblings) past the fixed release.
2. Delete patches/@better-auth__oauth-provider.patch and its patchedDependencies entry.
3. Delete the pinned "retire the patch" test in apps/auth/src/oauth.test.ts (explicit native + cursor:// registration).
4. Revisit the pinned "explicit web + http loopback → 400" test — if the release fixes #10913, web+loopback may start succeeding; the test failing is the intended signal, not a regression.
5. Keep the hook coercion/defaulting: clients that omit application_type or send Cursor's erroneous web still need it regardless of upstream (MCP spec 2026-07-28 requires clients to send it; several don't).

Sentinel: the pinned tests above fail on the offending bump, pointing here.