fix(auth): declare GitHub's issuer so RFC 9207 iss validation passes (#139)

GitHub now returns an RFC 9207 `iss` parameter on the OAuth callback
(`iss=https://github.com/login/oauth`). oauth4webapi validates it against
`as.issuer`, and @auth/core fills that with the placeholder
"https://authjs.dev" for non-OIDC providers, so every GitHub sign-in dies
with CallbackRouteError — which the error page reports to users as
/api/auth/error?error=Configuration ("There is a problem with the server
configuration"), even though nothing in the config is actually wrong.

Declaring the real issuer makes the comparison pass. Safe to set: the
provider already defines token/userinfo URLs, so this does not switch
@auth/core onto the OIDC discovery path. Google is unaffected because it
discovers its issuer from OIDC metadata.

Affects every deployment on next-auth 5.0.0-beta.25 (@auth/core 0.37.2,
oauth4webapi 3.1.4). GitHub first shipped this April 6-10 2026, put it on
hold on April 15 after it broke next-auth, then re-enabled it around
2026-08-19 with no announcement.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/lib/auth.ts

@@ -104,6 +104,7 @@ export const {
       clientId: process.env.AUTH_GITHUB_ID,
       clientSecret: process.env.AUTH_GITHUB_SECRET,
       allowDangerousEmailAccountLinking: true,
+      issuer: "https://github.com/login/oauth",
     }),
     Google({
       clientId: process.env.AUTH_GOOGLE_ID,