fix: validate Google OAuth state on callback

[boalambo]

Description

This fix hardens the Google OAuth login flow by generating a cryptographically secure state value and validating it on the callback before exchanging the authorization code. This closes the login CSRF gap where an attacker could forge a callback with a mismatched or missing state.

Changes

• Added secure state generation in oauth.ts
• Added a shared validateState check and used it in the Google callback flow in route.ts
• Kept the middleware security headers compatible with the project’s nonce-based CSP expectations in security.ts
• Added regression coverage in oauth.test.ts

Related Issue

Closes #1159

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Checklist

• Code follows project style guidelines
• Self-review completed
• No console errors
• Uses Lucide icons consistently
• Responsive design implemented
• Starknet best practices followed

[drips-wave]

@boalambo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project.