fix(auth): migrate tokens from localStorage to httpOnly cookies + CSRF hardening

Backend:
- Auth controller sets httpOnly secure cookies (access_token, refresh_token, goodgo_authenticated) on login/register/refresh
- JWT strategy reads token from cookie first, falls back to Authorization header
- Added POST /auth/logout to clear auth cookies
- Added POST /auth/exchange-token for OAuth callback token-to-cookie exchange
- Refresh endpoint reads refresh_token from cookie (body fallback for backwards compat)
- CSRF middleware excludes auth endpoints (login, register, refresh, exchange-token, logout)

Frontend:
- Removed all localStorage token storage (goodgo_tokens key)
- Removed authGet/authPost/authPatch helpers from api-client (tokens sent via cookies)
- All API calls use credentials:'include' for cookie-based auth
- Updated auth-store: no more token state, uses isAuthenticated flag from cookie
- Updated admin-api, listings-api to remove explicit token parameters
- Updated all pages (admin dashboard, users, KYC, moderation, listings) to remove token passing
- OAuth callbacks use exchange-token endpoint to convert URL tokens to cookies
- Auth provider simplified (no client-side cookie management needed)

Security improvements:
- JWT no longer accessible via JavaScript (XSS-safe)
- Refresh token scoped to /auth path only
- Server-side goodgo_authenticated cookie with SameSite=Lax
- Access token cookie with SameSite=Strict

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/components/providers/auth-provider.tsx

@@ -3,25 +3,12 @@
 import { useEffect } from 'react';
 import { useAuthStore } from '@/lib/auth-store';
 
-function setAuthCookie(authenticated: boolean) {
-  if (authenticated) {
-    document.cookie = 'goodgo_authenticated=1; path=/; max-age=604800; SameSite=Lax';
-  } else {
-    document.cookie = 'goodgo_authenticated=; path=/; max-age=0';
-  }
-}
-
 export function AuthProvider({ children }: { children: React.ReactNode }) {
   const initialize = useAuthStore((s) => s.initialize);
-  const tokens = useAuthStore((s) => s.tokens);
 
   useEffect(() => {
     initialize();
   }, [initialize]);
 
-  useEffect(() => {
-    setAuthCookie(!!tokens);
-  }, [tokens]);
-
   return <>{children}</>;
 }