fix(auth): upgrade Better Auth to 1.7.2

[romanbsd]

Why

CompCRM uses Better Auth 1.6.25 while the current runtime packages are 1.7.2.
Better Auth 1.7.2 changes social-link routes, client methods, hook data, and token refresh inputs.

Summary

• Upgrade Better Auth, API key, and SSO packages to 1.7.2.
• Keep the existing Better Auth CLI version because the registry reports an older version.
• Replace removed generic OAuth client APIs with core social APIs.
• Update Slack authorization guards for the new routes and provider fields.
• Resolve mailbox tokens through account identifiers.
• Update Slack integration tests to exercise Better Auth's real routes.

Validation

• bun run check-types
• bun run lint
• bun run lint:slop
• Auth package tests: 42 passed.
• API authentication tests: 5 passed.
• Webpack production build passed.
• git diff --check

---

Summary by cubic

Upgrades Better Auth from 1.6.25 to 1.7.2 and adapts auth flows to its breaking changes.

Changes

• Bump better-auth, @better-auth/api-key, @better-auth/sso, and the auth CLI package to 1.7.2.
• Replace the removed generic OAuth client with the linkSocial client method.
• Move the Slack callback to /api/auth/callback/slack; existing Slack apps must update their redirect URL before this ships.
• The Slack guard now covers /link-social starts and /callback/:id callbacks whose OAuth state identifies a linking transaction, so public Slack sign-in passes through.
• Resolve mailbox access tokens via account identifiers and return a needs-reconnect outcome when no account is found.
• Add migration 20260830221000_better_auth_account_identity to backfill issuer and Microsoft oid identities; it aborts if any Microsoft row lacks a trusted mapping and removes accounts whose SSO provider was deleted.

^{Written for commit 0a14223. Summary will update on new commits.}

[vercel]

@romanbsd is attempting to deploy a commit to the Comp AI - PoC Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 18 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[romanbsd]

Review fixes are consolidated in 0f42139. Public Slack sign-in remains available without a CRM session.

[romanbsd]

All review fixes are consolidated in bca062f. Better Auth remains upgraded to exact version 1.7.2.

[cubic-dev-ai]

All reported issues were addressed across 18 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[romanbsd]

The null-safe Microsoft migration guard is included in c37621d. All 57 migrations pass from a clean database.

[cubic-dev-ai]

All reported issues were addressed across 18 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 18 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>