fix(auth): migrate tokens from localStorage to httpOnly cookies + CSRF hardening

Backend:
- Auth controller sets httpOnly secure cookies (access_token, refresh_token, goodgo_authenticated) on login/register/refresh
- JWT strategy reads token from cookie first, falls back to Authorization header
- Added POST /auth/logout to clear auth cookies
- Added POST /auth/exchange-token for OAuth callback token-to-cookie exchange
- Refresh endpoint reads refresh_token from cookie (body fallback for backwards compat)
- CSRF middleware excludes auth endpoints (login, register, refresh, exchange-token, logout)

Frontend:
- Removed all localStorage token storage (goodgo_tokens key)
- Removed authGet/authPost/authPatch helpers from api-client (tokens sent via cookies)
- All API calls use credentials:'include' for cookie-based auth
- Updated auth-store: no more token state, uses isAuthenticated flag from cookie
- Updated admin-api, listings-api to remove explicit token parameters
- Updated all pages (admin dashboard, users, KYC, moderation, listings) to remove token passing
- OAuth callbacks use exchange-token endpoint to convert URL tokens to cookies
- Auth provider simplified (no client-side cookie management needed)

Security improvements:
- JWT no longer accessible via JavaScript (XSS-safe)
- Refresh token scoped to /auth path only
- Server-side goodgo_authenticated cookie with SameSite=Lax
- Access token cookie with SameSite=Strict

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/lib/auth-api.ts

@@ -1,11 +1,5 @@
 import { apiClient } from './api-client';
 
-export interface TokenPair {
-  accessToken: string;
-  refreshToken: string;
-  expiresIn: number;
-}
-
 export interface UserProfile {
   id: string;
   email: string | null;
@@ -31,12 +25,24 @@ export interface LoginPayload {
 }
 
 export const authApi = {
-  register: (data: RegisterPayload) => apiClient.post<TokenPair>('/auth/register', data),
+  register: (data: RegisterPayload) =>
+    apiClient.post<{ message: string }>('/auth/register', data),
 
-  login: (data: LoginPayload) => apiClient.post<TokenPair>('/auth/login', data),
+  login: (data: LoginPayload) =>
+    apiClient.post<{ message: string }>('/auth/login', data),
 
-  refresh: (refreshToken: string) =>
-    apiClient.post<TokenPair>('/auth/refresh', { refreshToken }),
+  refresh: () =>
+    apiClient.post<{ message: string }>('/auth/refresh'),
 
-  getProfile: (token: string) => apiClient.authGet<UserProfile>('/auth/profile', token),
+  logout: () =>
+    apiClient.post<{ message: string }>('/auth/logout'),
+
+  exchangeToken: (accessToken: string, refreshToken: string, expiresIn?: number) =>
+    apiClient.post<{ message: string }>('/auth/exchange-token', {
+      accessToken,
+      refreshToken,
+      expiresIn,
+    }),
+
+  getProfile: () => apiClient.get<UserProfile>('/auth/profile'),
 };