* chore(auth): upgrade better-auth 1.3.12 → 1.6.11
* chore(auth): address Greptile review — broaden change-email type + migration newline
* fix(auth): correct oneTimeToken expiresIn unit (minutes, not seconds)
Better-auth's oneTimeToken expiresIn is in minutes (multiplied by 60_000ms
internally). Sim's existing 24*60*60 evaluated to ~60 days of token
lifetime instead of the intended 24 hours. Tokens are one-time-use and
typically consumed within seconds of generation (Socket.IO handshake),
so this tightens an unused security window without affecting UX.
Waleed
34c47f7e93