fix: disable better-auth update-user endpoint

Names and avatars come from GitHub at sign-up; prevent signed-in users
from renaming themselves to impersonate other commenters.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

lib/auth.ts

@@ -15,6 +15,8 @@ export const auth = betterAuth({
     schema,
   }),
   plugins: [dash(), nextCookies()],
+  // names and avatars come from GitHub at sign-up; don't let users rename themselves (e.g. to impersonate someone)
+  disabledPaths: ["/update-user"],
   socialProviders: {
     github: {
       clientId: process.env.GITHUB_CLIENT_ID!,