deps: move better-auth family off the 1.7.0-rc.1 prerelease to a stable ^1.7.x line

[os-zhuang]

Context

PR #2986 (fixing #2974) pinned the entire better-auth family to the prerelease 1.7.0-rc.1 in pnpm-workspace.yaml overrides. This was the only way to remediate GHSA-p2fr-6hmx-4528 (@better-auth/oauth-provider, Medium 6.4): the advisory is patched only in the 1.7 line, whose plugins import symbols (e.g. CLIENT_ASSERTION_TYPE) that exist only in @better-auth/core 1.7.x — so the whole stack had to move together (mixing a 1.7 plugin with 1.6.23 core 500s on sign-in).

It also matched the pre-existing @better-auth/scim@1.7.0-rc.1 pin already in plugin-auth.

Why this is a follow-up

Running the auth stack on a release candidate in main is a temporary measure. When a stable 1.7.x ships, we should move to a normal ^1.7.x range so we're not carrying an rc long-term.

Pinned packages (all → 1.7.0-rc.1, in pnpm-workspace.yaml)

• better-auth
• @better-auth/core
• @better-auth/oauth-provider
• @better-auth/scim
• @better-auth/sso
• @better-auth/drizzle-adapter, kysely-adapter, memory-adapter, mongo-adapter, prisma-adapter
• @better-auth/telemetry

Action items (when stable 1.7.x is available)

• Replace the …@<1.7.0-rc.1': '1.7.0-rc.1' overrides with a stable ^1.7.x (or drop the overrides entirely if plugin-auth's declared ranges already resolve to the fixed line).
• Update plugin-auth's direct @better-auth/scim pin (currently exact 1.7.0-rc.1) to ^1.7.x.
• Re-run osv-scanner --lockfile=pnpm-lock.yaml to confirm GHSA-p2fr-6hmx-4528 stays resolved.
• Re-run the @objectstack/dogfood suite (the sign-in / JWKS path exercised by better-auth 1.7).
• Confirm the two new CustomAdapter methods (consumeOne/incrementOne) and the sys_jwks.alg/crv columns are still correct against the stable release (no further schema/contract drift).

Ref: #2974, #2986.