fix(auth): case-insensitive lookups no longer treat _ and % as wildcards

[jsnyder10]

Security fix — patch release of @factiii/auth

Case-insensitive email and username lookups in the Prisma adapter now match exactly. On Postgres, Prisma's mode: 'insensitive' equals compiles to ILIKE, so _ and % in the value acted as pattern characters and a lookup could return a different account.

• utilities/emailMatch.ts: escapeLikePattern (escapes \, %, _) and sameIdentifier (case-insensitive exact compare; null never matches).
• adapters/prismaAdapter.ts: the three insensitive lookups send the escaped value and re-check the returned row.
• Defence in depth: OAuth attach-by-email, signup checks, login lookup, username change, password reset request, 2FA reset, and resolveLoginMethods re-check the lookup result.
• Drizzle adapter unchanged (already lower(col) = lower($1)).

Verified on a real Postgres database: an escaped look-alike no longer matches, and an exact address in different case still does.

Tests: 224/224 (10 new in tests/insensitiveLookup.test.ts). changeset status: patch for @factiii/auth only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H7frtoCH37E4RjrPC6zLPc