fix(agent-auth): prefer host kid over id lookup

[onmax]

Problem

@better-auth/agent-auth currently resolves a host JWT's iss claim against the database id before checking kid.

The protocol uses an RFC 7638 JWK thumbprint for iss. When the database uses UUID ids, the first lookup can reject that thumbprint before the valid kid lookup runs.

Patch

The patch changes host resolution to check kid first. It keeps the id fallback for non-thumbprint values and skips that fallback for 43-character base64url thumbprints.

- findHostById(iss) ?? findHostByKid(iss)
+ findHostByKid(iss) ??
+   (isThumbprint(iss) ? null : findHostById(iss))

The same order is used by the shared route helper and both middleware host checks.

host JWT
  iss = JWK thumbprint
        |
        v
  findHostByKid(iss)  ---> host found
        |
        +---------------> non-thumbprint? findHostById(iss)
        |
        +---------------> thumbprint? stop

The pnpm patch reproduction and fixed control are available here:
https://github.com/onmax/repros/tree/repro/better-auth-agent-auth-host-lookup