docs(client): name the split-out findings #17234 / #17235 at their pins

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

Author: claude

.changeset/client-get-session-envelope-and-refresh-read.md

@@ -60,4 +60,5 @@ stays signed in across the call.
 Two answers stay outside the declared type and are **not** addressed here: the
 anonymous `null`, which would need the published return annotation to widen, and
 `SessionUser.image`, declared `z.string().optional()` against a route that
-serves `null`. Both are filed separately.
+serves `null` (#17235). The sibling `auth.login` / `auth.register`, which
+normalize into `data` but set no `success`, are #17234.

packages/client/src/auth-get-session-envelope.test.ts

@@ -213,7 +213,7 @@ describe('[#16760] /get-session is lifted into the SessionResponse envelope it d
       // nothing to do with this card and that the lift cannot reach:
       // `SessionUserSchema.image` is declared `z.string().optional()`, which
       // does not admit `null`, and better-auth serves `"image": null` for a
-      // user who never set one.
+      // user who never set one. Filed as #17235 — delete this case with it.
       //
       // Pinned as the exhaustive issue list rather than as "it fails": if the
       // envelope ever regresses, the missing `success` and `data` show up here