chore: sync upstream v1.6.5 + bump @btst to v2.2.2

[cursor]

Summary

Weekly upstream sync with better-auth/better-auth v1.6.5 (from v1.6.2).

Upstream changes included (v1.6.3 → v1.6.5)

• fix: honor forceAllowId UUIDs on postgres adapters (fix: honor forceAllowId UUIDs on postgres adapters better-auth/better-auth#9068)
• fix(two-factor): revert enforcement broadening (fix(two-factor): revert enforcement broadening from #9122 better-auth/better-auth#9205)
• fix(two-factor): updated backup codes respect storeBackupCodes option (fix(two-factor): updated backup codes respect storeBackupCodes option better-auth/better-auth#7231)
• fix(client): trigger $sessionSignal for session-rotating endpoints (fix(client): trigger $sessionSignal for session-rotating endpoints better-auth/better-auth#9087)
• fix(client): prevent isMounted race condition causing many rps (fix(client): prevent isMounted race condition causing many rps better-auth/better-auth#9078)
• fix(auth): harden dynamic baseURL resolution (fix(auth): harden dynamic baseURL resolution better-auth/better-auth#9131)
• fix: resolve dynamic baseURL for direct auth.api calls (fix: resolve dynamic baseURL for direct auth.api calls better-auth/better-auth#9113)
• fix(stripe): prevent prototype pollution via user-supplied metadata (fix(stripe): prevent prototype pollution via user-supplied metadata better-auth/better-auth#9164)
• fix(oauth-provider): graceful DCR override for unauthenticated confidential clients (fix(oauth-provider): graceful DCR override for unauthenticated confidential clients better-auth/better-auth#9123)
• chore(adapters): require patched drizzle-orm and kysely peer versions (chore(adapters): require patched drizzle-orm and kysely peer versions better-auth/better-auth#9165)

@BTST changes

• Bumped all 8 @btst/* packages from 2.2.1 → 2.2.2 (patch bump — pure upstream sync, no new @BTST features)
• Fixed trailing spaces in scripts/sync-upstream.ts HEADER_COMMENT to prevent Biome lint failures on future syncs

Conflicts resolved

• docs/content/blogs/1-5.mdx — accepted upstream
• pnpm-lock.yaml — accepted upstream, re-ran pnpm install --no-frozen-lockfile

CI checks

• ✅ pnpm lint (Biome)
• ✅ pnpm lint:spell (cspell)
• ✅ pnpm format:check (remark)
• ✅ pnpm lint:types (attw + tsc)
• ✅ pnpm --filter "@btst/*" exec tsc --noEmit
• ✅ @btst/db tests — all pass
• ✅ @btst/adapter-memory tests — all pass
• ✅ @btst/cli schema-conversion.test.ts — all pass
• ✅ @btst/cli generate-all-orms.test.ts — 20 tests pass, no snapshot changes
• ⚠️ @btst/cli e2e-cli.test.ts — fails as expected (needs live Postgres + MySQL, CI-only)

Post-merge release steps

After merging to main:

git checkout main && git pull
git tag btst-v2.2.2
git push origin btst-v2.2.2
# Then create GitHub Release from that tag