fix: distinguish identity session failures

Principal resolution could not tell a broken session store from a genuinely
anonymous request, and did unnecessary database work for callers that never
presented a session at all. Both are corrected here.

Any cookie previously triggered the ambiguity check, so `Cookie: x=y` on an
otherwise anonymous request caused an identity database round trip an
unauthenticated caller could drive with a header they chose themselves.
`hasConfiguredSessionCookie` now parses the Cookie header per RFC 6265 (split
on `;`, name is the text before the first `=`, trimmed) and compares the whole
name exactly — never `includes`, a substring test, or an unanchored regular
expression — so `better-auth.session_token_x`, `x_better-auth.session_token`, a
differently-cased spelling, and a percent-encoded lookalike are all correctly
not the session cookie. A duplicated name still reports true: ambiguity fails
safe towards checking, and reporting true never grants access on its own.

The cookie name is not a second hard-coded copy. One `betterAuthOptions` object
now feeds both `betterAuth()` and Better Auth's own supported `getCookies`
helper, so the detected name — including the `__Secure-` prefix an https baseURL
implies — is derived from the exact configuration Better Auth itself uses, and
drift is structurally impossible rather than merely tested.

The readiness check itself proved almost nothing: `select 1` still succeeded
against a dropped session table, a drifted or removed column, or a revoked
SELECT privilege, so Better Auth's ambiguous null was reported as a genuinely
anonymous request. `probeSessionStore` now plans a real read of the session
relation and the exact columns the adapter depends on, under `where false`:
PostgreSQL resolves the relation, every column, and the caller's privilege at
plan time while matching zero rows, so no session row, token, or user id can be
read, logged, or enumerated by the check. It uses the injected pool, never a
second connection, and stays bounded by the existing timeout.

A missing relation, dropped column, revoked privilege, unreachable connection,
and query timeout now all produce the same sanitized 503 with no relation name,
column name, SQL, driver text, host, or stack — proven against real PostgreSQL,
since that is the only place a broken store looks exactly like an anonymous
request.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/development/api.md

@@ -87,7 +87,7 @@ Authenticated:
 { "kind": "authenticated", "userId": "2aKp4jPeV1QbXwyz1OH6IcAUfl2n1fc1" }
 ```
 
-Infrastructure failure (the identity database could not be reached while resolving the principal —
+Infrastructure failure (the identity session store was not usable while resolving the principal —
 never silently reported as anonymous):
 
 ```json
@@ -95,6 +95,13 @@ never silently reported as anonymous):
 ```
 returned with HTTP `503`.
 
+A request carrying no cookies, or only unrelated cookies, never reaches that path and never performs
+identity database work at all: only a request presenting the *configured session cookie* that Better
+Auth resolved to `null` is ambiguous enough to check. When it is checked, a missing session table, a
+dropped column, a revoked `SELECT` privilege, an unreachable database, and a query timeout all
+produce this same sanitized `503` — carrying no relation name, column name, SQL, driver message,
+host, or stack. See [Identity § How a principal is resolved](identity.md#how-a-principal-is-resolved).
+
 This is deliberately not the same thing as Better Auth's own `GET /api/auth/get-session` response,
 which returns Better Auth's full `{session, user}` shape (session id, expiry, IP address, user
 agent, email, name, image, email-verification status, and more). `/api/v1/principal` is the