fix(plugin-auth)!: session payload positions[] is the security axis, not the better-auth role scalar

fix(plugin-auth)!: session payload positions[] is the security axis, not the better-auth role scalar #5522