docs(two-factor): mark viewBackupCodes as server-only in its API comment (#9822)

.changeset/two-factor-view-backup-codes-jsdoc.md

@@ -0,0 +1,7 @@
+---
+"better-auth": patch
+---
+
+Document `viewBackupCodes` as a server-only function so its API comment no longer reads like an HTTP route.
+
+The JSDoc above `auth.api.viewBackupCodes` advertised `POST /two-factor/view-backup-codes`, but the endpoint is server-only: it is not registered on the HTTP router and has no client method. The comment now states that it is callable only from trusted server code and that the `userId` should come from an authenticated session.

packages/better-auth/src/plugins/two-factor/backup-codes/index.ts

@@ -507,9 +507,10 @@ export const backupCode2fa = (opts: BackupCodeOptions) => {
 				},
 			),
 			/**
-			 * ### Endpoint
-			 *
-			 * POST `/two-factor/view-backup-codes`
+			 * A server-only function that returns a user's decrypted two-factor
+			 * backup codes. It is not exposed over HTTP and has no client method;
+			 * call it from trusted server code with a `userId` taken from an
+			 * authenticated session.
 			 *
 			 * ### API Methods
 			 *