fix(identity): sys_verification.value must not be UNIQUE — it breaks OIDC authorize (#2333)

better-auth's oauth-provider stores OIDC authorization codes in the verification
table with `value` = a JSON blob (keyed by user + client + state) that can
legitimately repeat. The UNIQUE index on `value` makes
`/api/v1/auth/oauth2/authorize` fail with `UNIQUE constraint failed:
sys_verification.value` → HTTP 503, which breaks cloud-as-IdP SSO
("Continue with ObjectStack") entirely — the authorize loops forever.

better-auth keys verification lookups on `identifier` (indexed), not `value`,
so a non-unique index on `value` is sufficient.

Found via a local browser E2E of the env→cloud OIDC SSO flow (ADR-0024 D3).
NOTE: existing control-plane DBs already have `uniq_sys_verification_value`;
they need a migration to drop it (schema-sync is additive).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/platform-objects/src/identity/sys-verification.object.ts

@@ -67,7 +67,13 @@ export const SysVerification = ObjectSchema.create({
   },
 
   indexes: [
-    { fields: ['value'], unique: true },
+    // `value` must NOT be unique. better-auth's oauth-provider stores OIDC
+    // authorization codes in this table with `value` = a JSON blob keyed by
+    // user+client+state, which can legitimately repeat. A UNIQUE constraint
+    // makes `/api/v1/auth/oauth2/authorize` fail (`UNIQUE constraint failed:
+    // sys_verification.value`) → 503, breaking cloud-as-IdP SSO entirely.
+    // better-auth keys verification lookups on `identifier`, not `value`.
+    { fields: ['value'], unique: false },
     { fields: ['identifier'], unique: false },
     { fields: ['expires_at'], unique: false },
   ],