fix(auth): migrate tokens from localStorage to httpOnly cookies + CSRF hardening

Backend:
- Auth controller sets httpOnly secure cookies (access_token, refresh_token, goodgo_authenticated) on login/register/refresh
- JWT strategy reads token from cookie first, falls back to Authorization header
- Added POST /auth/logout to clear auth cookies
- Added POST /auth/exchange-token for OAuth callback token-to-cookie exchange
- Refresh endpoint reads refresh_token from cookie (body fallback for backwards compat)
- CSRF middleware excludes auth endpoints (login, register, refresh, exchange-token, logout)

Frontend:
- Removed all localStorage token storage (goodgo_tokens key)
- Removed authGet/authPost/authPatch helpers from api-client (tokens sent via cookies)
- All API calls use credentials:'include' for cookie-based auth
- Updated auth-store: no more token state, uses isAuthenticated flag from cookie
- Updated admin-api, listings-api to remove explicit token parameters
- Updated all pages (admin dashboard, users, KYC, moderation, listings) to remove token passing
- OAuth callbacks use exchange-token endpoint to convert URL tokens to cookies
- Auth provider simplified (no client-side cookie management needed)

Security improvements:
- JWT no longer accessible via JavaScript (XSS-safe)
- Refresh token scoped to /auth path only
- Server-side goodgo_authenticated cookie with SameSite=Lax
- Access token cookie with SameSite=Strict

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/lib/listings-api.ts

@@ -134,10 +134,9 @@ export interface SearchListingsParams {
 const API_BASE_URL = process.env['NEXT_PUBLIC_API_URL'] || 'http://localhost:3001';
 
 export const listingsApi = {
-  create: (token: string, data: CreateListingPayload) =>
-    apiClient.authPost<{ listingId: string; propertyId: string; status: string }>(
+  create: (data: CreateListingPayload) =>
+    apiClient.post<{ listingId: string; propertyId: string; status: string }>(
       '/listings',
-      token,
       data,
     ),
 
@@ -152,20 +151,20 @@ export const listingsApi = {
     return apiClient.get<PaginatedResult<ListingDetail>>(`/listings${qs ? `?${qs}` : ''}`);
   },
 
-  updateStatus: (token: string, id: string, status: ListingStatus, moderationNotes?: string) =>
-    apiClient.authPost<{ status: string }>(`/listings/${id}/status`, token, {
+  updateStatus: (id: string, status: ListingStatus, moderationNotes?: string) =>
+    apiClient.post<{ status: string }>(`/listings/${id}/status`, {
       status,
       moderationNotes,
     }),
 
-  uploadMedia: async (token: string, listingId: string, file: File, caption?: string) => {
+  uploadMedia: async (listingId: string, file: File, caption?: string) => {
     const formData = new FormData();
     formData.append('file', file);
     if (caption) formData.append('caption', caption);
 
     const res = await fetch(`${API_BASE_URL}/listings/${listingId}/media`, {
       method: 'POST',
-      headers: { Authorization: `Bearer ${token}` },
+      credentials: 'include',
       body: formData,
     });