docs(hono): correct "the fix in either direction" — one direction can have none

Commit 6e28797 on this branch says, of the rule-A refusal:

  "a `prefix` that base path is not inside refuses at construction, naming
   both values and the fix in either direction"

The first half holds; the second does not, and history may not be rewritten
here, so this commit is the correction and the quote above is what it
corrects.

A single-segment base path such as `/auth` has NO usable parent prefix:
`''` is coerced straight back to `/api` by `options.prefix || '/api'`, and
`'/'` makes the dispatcher catch-all `'//*'` and every other route of the
app `//…`, which 404s. So for that composition only one direction exists —
configuring better-auth under the prefix the caller asked for — and the
refusal now offers exactly the directions that construct rather than one
per side regardless.

The changeset carried the same sentence and is corrected with it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

.changeset/hono-auth-mount-follows-auth-base-path.md

@@ -24,6 +24,6 @@ POST /api/v1/auth/delete-user                      ->  401  {"message":"Unauthor
 **Neither default moves.** `prefix` still defaults to `/api` and the auth `basePath` still defaults to `/api/v1/auth`. What changed is which of the two decides the mount:
 
 - **`@objectstack/hono`** — the `/auth/*` mount is derived from the auth service's configured `basePath`, read at app-construction time, rather than from `prefix`. An auth service that does not expose its base path keeps the previous `${prefix}/auth` mount, so a custom or older auth service is unaffected.
-- **`@objectstack/hono`** — a `prefix` the auth base path is not inside now **refuses at construction**, naming both values and the one-line fix in either direction. Previously that composition served auth outside the namespace the host asked for while `${prefix}/auth/*` answered `200 {}`. This is the one behaviour that can stop an app booting: a deployment passing, say, `prefix: '/custom'` alongside the default auth base path was already not serving auth, and now says so instead of failing silently.
+- **`@objectstack/hono`** — a `prefix` the auth base path is not inside now **refuses at construction**, naming both values and every one-line fix that actually constructs: move the app up to the base path's own parent namespace, or configure better-auth down under the prefix (carrying the leading slash the prefix may itself be missing). ⛔ A direction with no working answer is not offered rather than offered wrongly — a single-segment base has no usable parent prefix, because `''` falls back to `/api` and `'/'` mounts every other route of the app under `//`. Previously that composition served auth outside the namespace the host asked for while `${prefix}/auth/*` answered `200 {}`. This is the one behaviour that can stop an app booting: a deployment passing, say, `prefix: '/custom'` alongside the default auth base path was already not serving auth, and now says so instead of failing silently.
 - **`@objectstack/plugin-auth`** — `AuthManager.getBasePath()` is new and public: it returns the normalised base path better-auth is configured with. `createAuthInstance` hands better-auth exactly this string and the route-ownership walk reads the same call, where previously those two sites normalised it independently — as strings; they agreed behaviourally, because better-auth tolerates a missing leading slash. ⛔ It is **not** the single definition of that value. `getAuthIssuer()` and `getMcpResourceUrl()` still derive their own copies and are deliberately unchanged: they are the OAuth `iss` this AS advertises and the RFC 8707 resource identifier a token's `aud` is matched against, both compared by exact string by relying parties, so retiring their copies moves published identifiers and is not a tidy-up that belongs on this card.
 - **`@objectstack/plugin-auth`** — a `basePath` configured **with a trailing slash** (`'/api/v1/auth/'`) now configures better-auth with `'/api/v1/auth'`, where before it was handed the slash verbatim. Routing is identical (better-call strips trailing slashes itself); what changes is better-auth's own URL building — `ctx.baseURL` loses the trailing slash, so callback, magic-link and oauth-proxy URLs no longer carry a doubled `//`. The OAuth `iss` is unaffected: `getAuthIssuer()` derives its own and still keeps the configured slash.