docs(plugin-auth): name the card the two remaining basePath readers were filed as

The docblock and the changeset both said the surviving `getAuthIssuer()` /
`getMcpResourceUrl()` derivations were "reported" without saying where. They
are #16399, and a reader of either should be able to get there without
asking.

Prose only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

.changeset/hono-auth-mount-follows-auth-base-path.md

@@ -25,5 +25,5 @@ POST /api/v1/auth/delete-user                      ->  401  {"message":"Unauthor
 
 - **`@objectstack/hono`** — the `/auth/*` mount is derived from the auth service's configured `basePath`, read at app-construction time, rather than from `prefix`. An auth service that does not expose its base path keeps the previous `${prefix}/auth` mount, so a custom or older auth service is unaffected.
 - **`@objectstack/hono`** — a `prefix` the auth base path is not inside now **refuses at construction**, naming both values and every one-line fix that actually constructs: move the app up to the base path's own parent namespace, or configure better-auth down under the prefix (carrying the leading slash the prefix may itself be missing). ⛔ A direction with no working answer is not offered rather than offered wrongly — a single-segment base has no usable parent prefix, because `''` falls back to `/api` and `'/'` mounts every other route of the app under `//`. Previously that composition served auth outside the namespace the host asked for while `${prefix}/auth/*` answered `200 {}`. This is the one behaviour that can stop an app booting: a deployment passing, say, `prefix: '/custom'` alongside the default auth base path was already not serving auth, and now says so instead of failing silently.
-- **`@objectstack/plugin-auth`** — `AuthManager.getBasePath()` is new and public: it returns the normalised base path better-auth is configured with. `createAuthInstance` hands better-auth exactly this string and the route-ownership walk reads the same call, where previously those two sites normalised it independently — as strings; they agreed behaviourally, because better-auth tolerates a missing leading slash. ⛔ It is **not** the single definition of that value. `getAuthIssuer()` and `getMcpResourceUrl()` still derive their own copies and are deliberately unchanged: they are the OAuth `iss` this AS advertises and the RFC 8707 resource identifier a token's `aud` is matched against, both compared by exact string by relying parties, so retiring their copies moves published identifiers and is not a tidy-up that belongs on this card.
+- **`@objectstack/plugin-auth`** — `AuthManager.getBasePath()` is new and public: it returns the normalised base path better-auth is configured with. `createAuthInstance` hands better-auth exactly this string and the route-ownership walk reads the same call, where previously those two sites normalised it independently — as strings; they agreed behaviourally, because better-auth tolerates a missing leading slash. ⛔ It is **not** the single definition of that value. `getAuthIssuer()` and `getMcpResourceUrl()` still derive their own copies and are deliberately unchanged: they are the OAuth `iss` this AS advertises and the RFC 8707 resource identifier a token's `aud` is matched against, both compared by exact string by relying parties, so retiring their copies moves published identifiers and is not a tidy-up that belongs on this card (filed as #16399).
 - **`@objectstack/plugin-auth`** — a `basePath` configured **with a trailing slash** (`'/api/v1/auth/'`) now configures better-auth with `'/api/v1/auth'`, where before it was handed the slash verbatim. Routing is identical (better-call strips trailing slashes itself); what changes is better-auth's own URL building — `ctx.baseURL` loses the trailing slash, so callback, magic-link and oauth-proxy URLs no longer carry a doubled `//`. The OAuth `iss` is unaffected: `getAuthIssuer()` derives its own and still keeps the configured slash.

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -5495,8 +5495,8 @@ export class AuthManager {
    *
    * ⇒ ⛔ Do not read this method as licence to assume one answer exists. Two
    * more spellings of "the auth base path" are live in this file, and retiring
-   * them is a decision about published OAuth identifiers, not a tidy-up. It is
-   * reported to the PM rather than taken on a mount card.
+   * them is a decision about published OAuth identifiers, not a tidy-up. Filed
+   * as #16399 rather than taken on a mount card.
    *
    * ## What the two collapsed readers actually disagreed about
    *