chore(docs): update AGENTS.md to reflect recent changes

[RedStar071]

🔗 Linked issue

N/A — routine weekly AGENTS.md maintenance.

🧭 Context

Weekly review of PRs merged into main since the last maintenance pass (#295, merged 2026-07-12): reviewed #294, #288, #300, #297, and #302.

📚 Description

#297 (chore: migrate from nuxt-auth-utils to better-auth) was the significant gap. The entire "Auth and Feedback" section still described the now-deleted server/api/auth/discord.get.ts / server/utils/oauth-state.ts flow and the #auth-utils User type. Rewrote it to describe the current stack:

• server/auth.config.ts + defineServerAuth() from @onmax/nuxt-better-auth/config, with the Discord social provider, secondaryStorage rate limiting, and jwe session cookie cache
• server/middleware/oauth-callback.ts / server/utils/oauth-callback.ts redirecting Discord's response to the better-auth callback route
• server/api/auth/refresh.get.ts + server/utils/oauth-tokens.ts for token refresh
• event.context.$authorization (server) and the useUserSession() compat composable (client) as the actual current access points, replacing #auth-utils

That same migration orphaned four audit action creators (userLogin, userLogout, sessionRefresh, oauthStateInvalid) — they were only ever invoked from the deleted OAuth handler and nothing calls them now. Rather than leave the Action Registry table asserting they fire on login/logout/refresh/CSRF-failure, corrected it to say they're currently unwired and added a note explaining why (so this reads as a known gap, not a doc error). Also updated the evlog-session-bridge.ts reference in the Audit Logging key-files list to evlog-auth-identify.ts, which replaced it.

#294 (nuxt-skew-protection) added a client-outdated rejection (isClientOutdated()) to defineWrappedResponseHandler/defineWrappedCachedResponseHandler — a genuinely new reusable server API pattern — so documented it under "Server API Patterns".

Also refreshed the design-token allow-list description, which undercounted the app/components/discord/*.vue exemptions after #288/#294 added several more (role, scrollbar, the slash-command autocomplete family).

#300 (avatar layout fix) and #302 (agent skills sync) didn't touch anything architecturally relevant to AGENTS.md.

CLAUDE.md remains a symlink to AGENTS.md, so both stay in sync automatically.

---

Generated by an automated AGENTS.md maintenance routine.

---

Generated by Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is enabled.}

Confidence Score: 5/5

This docs-only PR is safe to merge.

The updated guide matches the current Better Auth files, deleted OAuth files, audit-action usage, and design-token allow-list.

No files require special attention.

T-Rex Logs

What T-Rex did

• T-Rex captured the before-state by recording the git/head context and AGENTS.md references prior to the checks.
• T-Rex ran the consistency-check script to validate the agent references.
• T-Rex captured the after-state showing the check results and the formatting warning from Prettier.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "chore(docs): update AGENTS.md to reflect..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 44 untouched benchmarks

---

_{Comparing claude/brave-johnson-pzr16c (d795a4c) with main (8babfde)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.53%. Comparing base (8babfde) to head (d795a4c).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #306   +/-   ##
=======================================
  Coverage   71.53%   71.53%           
=======================================
  Files         167      167           
  Lines        3302     3302           
  Branches      702      702           
=======================================
  Hits         2362     2362           
  Misses        447      447           
  Partials      493      493           

Flag	Coverage Δ
component	66.09% <ø> (ø)
unit	67.67% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.