fix: align oauth client seed with the better-auth 1.7 schema

[mroderick]

better-auth and @better-auth/oauth-provider 1.7 remove the oauthClient public column, so the raw planner-client seed fails on every schema the 1.7 migrations create: 31 of 81 tests fail on the dependency bump alone, and a fresh environment cannot seed at all. This PR makes the seed and its test match the 1.7 schema, and carries only the two dependency upgrades the fix needs.

• src/app/db/seed-client.js drops "public" from the column list and its bound value; the statement stays 12 columns to 12 values, and every other seeded value is unchanged.
• The test asserts that both removed columns (public, type) are absent and reads back skipConsent, so a schema drift in either direction fails the suite rather than passing silently.
• @better-auth/oauth-provider 1.6.27 -> 1.7.5 (exact pin) and better-auth ^1.6.20 -> ^1.7.5.
• The other nine bumps from chore(deps): bump the npm-deps group across 1 directory with 12 updates #81 are deliberately not included.

Review notes

Start with the seed statement. The Heroku release phase runs this same SQL under set -e against a database created by the 1.6 migrations, where public and type still exist. The 1.7 migrator only ever adds columns, so that path keeps working, and the statement no longer names the column on either shape of schema. The residual risk is structural rather than specific to this diff: the seed is raw SQL with no schema check, so a future column change fails at release time instead of at review time.

The better-auth range moved to ^1.7.5 rather than staying ^1.6.20 as it does in #81. The code now requires the 1.7 schema, and a lockfile-free install of ^1.6.20 could resolve a 1.6.x release and fail.

Deliberately not done: the remaining upgrades in #81 stay there — hono 4.13.9 (which carries GHSA-hxh3-vqpv-xpqv, a hono/jsx XSS fix; this application does not use hono/jsx), eslint, @playwright/test, fallow, prettier, tap, lint-staged, globals and commitlint. Nothing here needs them.

Also outside this PR, for a follow-up: after the upgrade the production table keeps public and type as dead columns, and the existing planner row keeps applicationType NULL.

Lockfile detail

Fourteen entries move, all consequences of better-auth 1.7.5:

• the auth subtree: better-auth, @better-auth/core, @better-auth/oauth-provider, @better-auth/{kysely,memory,mongo,prisma,drizzle}-adapter, @better-auth/telemetry
• @better-fetch/fetch 1.3.1 -> 1.3.2 (peer of oauth-provider 1.7)
• zod 4.4.3 -> 4.6.5, @types/node 26.0.0 -> 26.6.3, undici-types 8.3.0 -> 8.9.0 (transitive)
• the nested better-auth/node_modules/@better-auth/drizzle-adapter, which is hoisted to the root at 1.7.5

No other package in the lockfile changes: hono stays 4.13.5, eslint stays 10.8.1.

[till]

I haven't looked but maybe better auth has another way than an sql query?

I only found this:
better-auth/better-auth#10708

Not sure if admin api works from CLI?

[mroderick]

Practical approach — direct DB access: For your use case (seeding trusted first-party clients at startup), querying the database directly is likely the most straightforward path. After initializing your Better Auth instance, you have access to the internal adapter/ORM. You could:

Query the oauthClient table to check if your pre-defined clients exist by ID
Insert any missing ones directly, ensuring you hash the client_secret the same way Better Auth does (it uses Scrypt by default)
This is a reasonable pattern for system-owned clients — many OAuth server implementations handle first-party client seeding outside the standard registration API.

It seems that using direct access to database is the current "recommended" way to handle this.