fix(core): document that getToken returns null for malformed authorization headers

[gustavovalverde]

getToken() returns null when the token is missing or unusable, including when the Authorization header's Bearer value contains malformed percent-encoding, but the JSDoc did not state the null contract. Callers checking the return value have no documented guarantee to rely on. This documents it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auth-docs	Ready	Preview, Comment	Jul 20, 2026 9:13pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
next-auth-docs	Ignored	Preview	Jul 20, 2026 9:13pm
proxy	Ignored		Jul 20, 2026 9:13pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.85%. Comparing base (5b1aa47) to head (8afdfec).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13467   +/-   ##
=======================================
  Coverage   49.85%   49.85%           
=======================================
  Files         200      200           
  Lines       13487    13487           
  Branches     1445     1445           
=======================================
  Hits         6724     6724           
  Misses       6763     6763           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.