fix: verify OIDC ID tokens before mapping user info

[onhate]

What changed

• verify Telegram OIDC id_token signatures before getUserInfo maps profile claims
• share one verification path between getUserInfo and verifyIdToken so algorithm, key, issuer, audience, and expiry checks cannot drift
• add a bounded JWKS request timeout through oidc.jwksFetchTimeoutMs, defaulting to 10 seconds
• add signed-token regression coverage and document the new option and verification sequence

Why

Better Auth's authorization-code callback invokes the social provider's getUserInfo method directly. In v2.0.1, Telegram's getUserInfo decoded the returned id_token with decodeJwt and mapped those unverified claims. The separate verifyIdToken callback is used by Better Auth's direct ID-token sign-in routes, but not by the normal OAuth callback.

This change makes the authorization-code path fail closed unless the token has a supported signature, a matching Telegram JWKS key, the expected issuer and audience, and a valid expiry.

Compatibility

• accepted signing algorithms remain RS256, ES256, and EdDSA
• provider ID, scopes, profile mapping, placeholder email, and successful return shape are unchanged
• jwksFetchTimeoutMs is additive; existing configurations receive the 10-second default
• invalid non-positive or non-finite timeout values fail early during provider creation

Validation

• npm run test -- src/oidc.test.ts — 106 passed, 4 skipped
• npm test — 347 passed, 4 skipped
• npm run type-check
• npm run lint
• npm run build