fix(auth): preserve raw BetterAuth cookie token for session lookup

apps/api/src/auth/auth.service.spec.ts

@@ -426,6 +426,21 @@ describe("AuthService", () => {
       });
     });
 
+    it("should preserve raw cookie token value without URL re-encoding", async () => {
+      const auth = service.getAuth();
+      const mockGetSession = vi.fn().mockResolvedValue(mockSessionData);
+      auth.api = { getSession: mockGetSession } as any;
+
+      const result = await service.verifySession("tok/with+=chars=");
+
+      expect(result).toEqual(mockSessionData);
+      expect(mockGetSession).toHaveBeenCalledWith({
+        headers: {
+          cookie: "__Secure-better-auth.session_token=tok/with+=chars=",
+        },
+      });
+    });
+
     it("should fall back to Authorization header when cookie-based lookups miss", async () => {
       const auth = service.getAuth();
       const mockGetSession = vi