chore(spec): regen field reference doc, classify ackPlaintextMasking liveness, add changeset (#3420)

Follow-ups required by CI for the new field-level `ackPlaintextMasking` option:

- Regenerate content/docs/references/data/field.mdx (generated from FieldSchema).
- Classify field/ackPlaintextMasking as `live` in the spec liveness ledger — its
  consumer is warnGenericPasswordFields (object.zod.ts), proven by the ADR-0100
  author-warning suite in object.test.ts.
- Add the changeset for @objectstack/spec, @objectstack/objectql, @objectstack/plugin-auth.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXHXXHnquzVUjeQYPs9bmy

Author: claude

.changeset/startup-log-noise-cleanup.md

@@ -0,0 +1,24 @@
+---
+"@objectstack/spec": patch
+"@objectstack/objectql": patch
+"@objectstack/plugin-auth": patch
+---
+
+fix(dev): eliminate three fixed startup log warnings so official examples boot clean (#3420)
+
+`os dev` on the stock showcase printed three fixed noise sources on every boot,
+with zero example-side changes — training users to ignore warnings.
+
+- **spec** — add a field-level `ackPlaintextMasking: true` opt-out for the
+  generic `password` author-time warning (ADR-0100). A deliberately-masked
+  field (like field-zoo's `f_password`) can now affirm intent instead of
+  printing an un-actionable "safe to ignore" on every boot; the warning text
+  points authors at the flag.
+- **plugin-auth** — pass better-auth's documented
+  `silenceWarnings.oauthAuthServerConfig` to `oauthProvider(...)`. We already
+  mount the `/.well-known/oauth-authorization-server` documents ourselves at
+  the issuer root, so the plugin's "please ensure it exists" reminder was a
+  false positive (printed twice); silencing it removes both.
+- **objectql** — route the Registry's re-register / package-overwrite lines
+  (normal rebuild / HMR / seed-replay paths) through a new debug-only
+  `SchemaRegistry.debug()` so they stay out of the default `info` boot log.

content/docs/references/data/field.mdx

@@ -147,6 +147,7 @@ const result = Address.parse(data);
 | **hidden** | `boolean` | optional | Hidden from default UI |
 | **readonly** | `boolean` | optional | Read-only — never editable in forms, AND server-enforced on BOTH write paths: a non-system write to this field is silently dropped from the payload on UPDATE (#2948/#3003) and on INSERT (#3043; a create can no longer directly seed e.g. `approval_status: "approved"`), symmetric with `readonlyWhen`. A stripped INSERT field still falls back to its `defaultValue`; system-context writes (import, seed replay, migration) are exempt. |
 | **requiredPermissions** | `string[]` | optional | [ADR-0066 D3] Capabilities required to read/edit this field (mask on read, deny on write; AND-gate). |
+| **ackPlaintextMasking** | `boolean` | optional | [ADR-0100] Affirm a generic `password` field's plaintext-at-rest / masked-on-read contract is intended, silencing the author-time warning (#3420). No effect on non-password fields. |
 | **system** | `boolean` | optional | Auto-injected system/audit field (e.g. created_at, updated_by, organization_id). Tools that surface system fields separately from author-declared business fields should branch on this flag. |
 | **sortable** | `boolean` | optional | Whether field is sortable in list views |
 | **inlineHelpText** | `string` | optional | Help text displayed below the field in forms |

packages/spec/liveness/field.json

@@ -104,6 +104,11 @@
       "evidence": "packages/plugins/plugin-security/src/security-plugin.ts",
       "note": "ADR-0066 D3 field-level capability gate. getObjectSecurityMeta reads field.requiredPermissions; foldFieldRequiredPermissions forces non-readable+non-editable when the caller's systemPermissions don't cover them, so FieldMasker masks on read + detectForbiddenWrites denies on write (AND-gate). Unit-proven in packages/plugins/plugin-security/src/security-plugin.test.ts."
     },
+    "ackPlaintextMasking": {
+      "status": "live",
+      "evidence": "packages/spec/src/data/object.zod.ts",
+      "note": "ADR-0100 author-time diagnostic gate (#3420). warnGenericPasswordFields (object.zod.ts) reads field.ackPlaintextMasking and skips the generic-password plaintext-at-rest/masked-on-read warning for a field that affirms intent, so a deliberate demo (showcase field-zoo f_password, which exercises every field type) boots warning-free instead of printing an un-actionable 'safe to ignore'. Diagnostic-only: masking, the echoed-mask write guard, and the better-auth exemption are unchanged. Proven in packages/spec/src/data/object.test.ts (ADR-0100 password-field author warning suite: ackPlaintextMasking suppresses, partial-ack still warns about the un-acked field, warning text names the flag)."
+    },
     "system": {
       "status": "live",
       "evidence": "packages/objectql/src/engine.ts"