docs(sso): the OIDC flow uses /sign-in/social and /callback/:id

The OAuth flow section told readers to call POST /api/v1/auth/sign-in/oauth2,
a route nothing registers. better-auth's generic-OAuth plugin, which carries
the oidcProviders entries, adds no endpoints: it registers each entry as a
social provider, so sign-in starts at /sign-in/social with the entry's
providerId as `provider` and returns through /callback/:id.

Claude-Session: https://claude.ai/code/session_01VDtqoecgES7ScQYGbFVDRv
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/permissions/sso.mdx

@@ -379,11 +379,16 @@ The Console `/login` and `/register` pages will now show a button for each enabl
 4. Provider redirects to `/api/v1/auth/callback/google`.
 5. better-auth creates a session and redirects to `callbackURL`.
 
-**OIDC/enterprise providers**:
+**OIDC/enterprise providers** (`oidcProviders`): better-auth's generic-OAuth plugin
+registers each one as a social provider and adds no endpoints of its own, so the flow uses
+the same two routes as above.
 1. User clicks **Continue with Okta SSO**.
-2. Client calls `POST /api/v1/auth/sign-in/oauth2` with `{ providerId: "okta", callbackURL }`.
+2. Client calls `POST /api/v1/auth/sign-in/social` with `{ provider: "okta", callbackURL }`,
+   where `provider` is the entry's `providerId`.
 3. Browser redirects to the provider's authorization endpoint.
-4. Provider redirects back; better-auth validates the OIDC token and creates a session.
+4. Provider redirects to `/api/v1/auth/callback/okta`. better-auth exchanges the code, reads
+   the user's profile from the ID token or `userInfoUrl`, creates a session and redirects to
+   `callbackURL`.
 
 ## Linking to an existing account