addSessionToUser fails on auth collections with localized fields (MongoDB CastError)

Describe the Bug

addSessionToUser (exported from payload/shared) passes the entire user document to payload.db.updateOne. On MongoDB, when the auth collection has localized: true fields, this fails because findByID returns flattened locale values (e.g. displayName: "Test User") while Mongoose expects the embedded locale object (e.g. { en: "Test User", es: "..." }).

The same pattern exists in revokeSession.

Link to the code that reproduces this issue

https://github.com/MurzNN/payload-issues/tree/issue/add-session-to-user-localized-fields

Reproduction lives in test/_community/ (config.ts, int.spec.ts, README.md).

Reproduction Steps

1. Clone the reproduction branch:

git clone --branch issue/add-session-to-user-localized-fields https://github.com/MurzNN/payload-issues.git
cd payload-issues
pnpm install

2. Start MongoDB and run the integration test:

pnpm docker:start mongodb
PAYLOAD_DATABASE=mongodb pnpm test:int _community

3. The test reproduces CastError when addSessionToUser writes a flattened user document fails with:

CastError: Cast to Embedded failed for value "Test User" (type string) at path "displayName"
ObjectParameterError: Parameter "obj" to Document() must be an object, got "Test User" (type string)

Root cause (packages/payload/src/auth/sessions.ts):

await payload.db.updateOne({
  id: user.id,
  collection: collectionConfig.slug,
  data: user, // entire document — includes flattened localized fields
  req,
  returning: false,
})

Suggested fix: update only changed fields:

await payload.db.updateOne({
  id: user.id,
  collection: collectionConfig.slug,
  data: {
    sessions: user.sessions,
    updatedAt: null,
  },
  req,
  returning: false,
})

Which area(s) are affected?

• area: core
• db: mongodb

Environment Info

Payload: 3.85.2 (also reproduced against payload monorepo main / 4.0.0-beta.0)
Database adapter: @payloadcms/db-mongodb
Localization: enabled (en, es)
Node.js: 22.x

Encountered while implementing custom OTP login using Payload session/JWT helpers (addSessionToUser after findByID).

Start with packages/payload/src/auth/sessions.ts and inspect addSessionToUser and revokeSession, then run the reproduction in test/_community/ using the documented MongoDB integration-test commands. Done means localized auth collections no longer produce a MongoDB CastError when either session helper updates a user, with the existing reproduction passing.