docs(auth): baseline better-auth 'role' boundary refs + regen reference docs

check-role-word (ADR-0090 D3) flagged the two new mentions in
authentication.mdx — both refer to better-auth's literal `role` scalar
(a genuine boundary), so the file is baselined rather than reworded.
Also picks up the generated reference docs that lag the merged spec:
features.phoneNumber/phoneNumberOtp and the auth-config phoneNumber flag
(#2766/#2780), plus component.mdx's relationshipValueField row.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016r6eiJzivw1CkwTDSGho1o

Author: claude

content/docs/references/api/auth-endpoints.mdx

@@ -62,6 +62,8 @@ const result = AuthEndpoint.parse(data);
 | **magicLink** | `boolean` | ✅ | Magic link login enabled |
 | **organization** | `boolean` | ✅ | Multi-tenant organization support enabled |
 | **ssoEnforced** | `boolean` | optional | SSO-only login enforced: the UI hides the local password form + self-registration (a break-glass "use a password" link remains) |
+| **phoneNumber** | `boolean` | optional | Phone-number sign-in enabled (phone + password, #2766 V1.5) |
+| **phoneNumberOtp** | `boolean` | optional | Phone-number OTP sign-in and self-service password reset available — requires the phoneNumber plugin plus a deliverable SMS service (#2780) |
 
 
 ---

content/docs/references/system/auth-config.mdx

@@ -83,6 +83,7 @@ Advanced / low-level Better-Auth options
 | **dynamicClientRegistration** | `boolean` | optional | Allow unauthenticated RFC 7591 Dynamic Client Registration (default: follows OS_MCP_SERVER_ENABLED) |
 | **deviceAuthorization** | `boolean` | ✅ | Enable RFC 8628 Device Authorization Grant (CLI / TV-style login) |
 | **admin** | `boolean` | ✅ | Enable platform admin operations (ban/unban, set-password, impersonate, set-role) |
+| **phoneNumber** | `boolean` | ✅ | Enable phone-number sign-in (phone + password; OTP sign-in/reset when an SMS service is configured) |
 
 
 ---

content/docs/references/ui/component.mdx

@@ -346,6 +346,7 @@ Type: `string`
 | :--- | :--- | :--- | :--- |
 | **objectName** | `string` | ✅ | Related object name (e.g., "task", "opportunity") |
 | **relationshipField** | `string` | ✅ | Field on related object that points to this record (e.g., "account_id") |
+| **relationshipValueField** | `string` | ✅ | Parent-record field whose value relationshipField stores (default 'id'; e.g. 'name' for name-keyed junctions). |
 | **columns** | `string[]` | optional | Fields to display in the related list. Optional: when omitted, columns derive from the related object's highlightFields / default list columns (a related list is just another surface that lists that object). Override chain: child highlightFields → field-level relatedListColumns → this inline list. |
 | **sort** | `string \| Object[]` | optional | Sort order for related records |
 | **limit** | `integer` | ✅ | Number of records to display initially |

scripts/role-word-baseline.json

@@ -20,6 +20,7 @@
   "content/docs/kernel/runtime-services/examples.mdx": 2,
   "content/docs/kernel/runtime-services/sharing-service.mdx": 2,
   "content/docs/kernel/services-checklist.mdx": 5,
+  "content/docs/permissions/authentication.mdx": 2,
   "content/docs/permissions/authorization.mdx": 3,
   "content/docs/permissions/index.mdx": 1,
   "content/docs/permissions/permission-metadata.mdx": 2,