feat(web): add OAuth callback pages and auth flow for Google/Zalo

- Add /auth/callback/google and /auth/callback/zalo pages that extract
  tokens from query params and persist them via the auth store
- Add handleOAuthCallback method to Zustand auth store
- Update middleware to allow /auth/callback/* as public routes
- Show OAuth error messages on login page when redirected back

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/lib/auth-store.ts

@@ -2,6 +2,8 @@ import { create } from 'zustand';
 import { authApi, type TokenPair, type UserProfile, type LoginPayload, type RegisterPayload } from './auth-api';
 import { ApiError } from './api-client';
 
+export type { TokenPair };
+
 const TOKEN_KEY = 'goodgo_tokens';
 
 function persistTokens(tokens: TokenPair | null) {
@@ -32,6 +34,7 @@ interface AuthState {
 
   login: (data: LoginPayload) => Promise<void>;
   register: (data: RegisterPayload) => Promise<void>;
+  handleOAuthCallback: (tokens: TokenPair) => Promise<void>;
   logout: () => void;
   refreshToken: () => Promise<boolean>;
   fetchProfile: () => Promise<void>;
@@ -73,6 +76,19 @@ export const useAuthStore = create<AuthState>((set, get) => ({
     }
   },
 
+  handleOAuthCallback: async (tokens) => {
+    set({ isLoading: true, error: null });
+    try {
+      persistTokens(tokens);
+      set({ tokens, isLoading: false });
+      await get().fetchProfile();
+    } catch (e) {
+      const message = e instanceof ApiError ? e.message : 'Đăng nhập OAuth thất bại';
+      set({ isLoading: false, error: message });
+      throw e;
+    }
+  },
+
   logout: () => {
     persistTokens(null);
     set({ tokens: null, user: null, error: null });