better-auth's default username validator only allows [a-zA-Z0-9_.],
rejecting hyphens with a generic "invalid username or password" error.
Added a custom validator that also permits hyphens.
Closes#112
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>