fix(deps): bump x/net to v0.60.0 for http2 vulns

fix(deps): bump otel to v1.45.0 for vulncheck

fix(passkeys): count friendly_name length by runes, not bytes

fix: only trigger after-user-created hook on account creation (#2656)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

The external OAuth callback sets `createdUser = true` unconditionally,
discarding the `models.AccountLinkingDecision`. That branch handles
every OAuth sign-in, so `after-user-created` also fires for
`AccountExists` (returning user) and `LinkAccount` (new identity on an
existing user). Hook side effects therefore repeat on every sign-in, and
since the hook's error propagates out of the callback, a hook that
rejects a duplicate user breaks all OAuth sign-ins.

## What is the new behavior?

`createdUser` is gated on `decision == models.CreateAccount`, matching
the existing call sites in `token_oidc.go`, `web3.go` and `samlacs.go`.

## Additional context

Two regression tests in `ExternalTestSuite` cover the `AccountExists`
and `LinkAccount` paths.

feat(openapi): document mfa recovery codes endpoints

chore: silence git describe errors in Docker make deps (#2823)

Silences the errors from running `make deps` locally and in CI:

```
 => [auth 6/8] RUN make deps                                                                                                                                                  15.5s
 => => # fatal: not a git repository (or any of the parent directories): .git
 => => # fatal: not a git repository (or any of the parent directories): .git
 => => # fatal: not a git repository (or any of the parent directories): .git
 => => # fatal: not a git repository (or any of the parent directories): .git
 => => # fatal: not a git repository (or any of the parent directories): .git
 => => # fatal: not a git repository (or any of the parent directories): .git
```

These warnings are expected when `.git` does not exist.

feat(otp): handle test OTPs and Twilio Verify on the one_time_tokens …

…path (#2798)

Implementing the TestOTP + Twilio Verify logic that were intentionally
deferred in #2788.

## What kind of change does this PR introduce?
Feat

## What is the current behavior?
The `config.Experimental.EnableOTTAsSourceOfTruth` code path does not
support Test OTPs or Twilio Verify.

## What is the new behavior?
It does 🥳 

## Additional context
Closes AUTH-1553

feat(otp): switch one_time_tokens table to source of truth (#2788)

## What kind of change does this PR introduce?
Feat

## What is the current behavior?
We dual-write token data to the `one_time_tokens` and `users` table, but
read token data from them inconsistently.

## What is the new behavior?
When a flag `GOTRUE_EXPERIMENTAL_ENABLE_OTT_AS_SOURCE_OF_TRUTH` is
enabled, we treat `one_time_tokens` as the source of truth for token
data, and only lookup the user to validate eligibility and confirm
identifier binding.

## Additional context
I've intentionally split out the Twilio Verify flow + Test OTP handling
into a separate PR, but will wait until both are merged to release.

Closes AUTH-1553.

feat(otp): add one_time_tokens query helpers (#2797)

## What kind of change does this PR introduce?
Feature

## What is the current behavior?
There is no single-query lookup for a token hash and its
`pkce_`-prefixed form, and no lookup by `relates_to`.

Callers such as `FindUserByEmailChangeCurrentAndAudience` run two
`FindOneTimeToken` queries to cover the prefix, which is inefficient.

## What is the new behavior?
Adds two parent query methods used by the upcoming
OTT-as-source-of-truth work:
- `FindOneTimeTokenWithPKCEFallback`: single-query lookup that accepts
either an exact token hash or its `pkce_`-prefixed form, preferring the
exact match.
- `FindOneTimeTokenByRelatesTo`: looks up the newest token row for a
given `relates_to` value (e.g. phone number) and token type.

Along with:
- `PKCEPrefix` is now a constant in `models` that we reference vs.
string literals
- `FindOneTimeToken` and `FindOneTimeTokenWithPKCEFallback` now share
`findOneTimeToken`, guided by a `pkceFallback` flag.

Adds tests for those methods. Not updating existing callers for now to
reduce the radius of this change.

## Additional context
Contributes to AUTH-1553 but does not close.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

fix(mfa): regenerate duplicate recovery codes (#2793)