fix(security): authenticate connect callback and replace Math.random OAuth state

[anshul23102]

Fixes #161

Changes

1. Add preHandler: [app.authenticate] to the connect callback (connect.ts)

The callback route now requires a valid session. After decoding the state, the embedded userId is compared against the authenticated user's id:

app.get('/github/callback', {
  preHandler: [app.authenticate],
}, async (request, reply) => {
  ...
  const sessionUserId = (request.user as any).id;
  if (!decodedState.userId || decodedState.userId !== sessionUserId) {
    return reply.redirect(`${process.env.PUBLIC_APP_URL}/settings?error=invalid_state`);
  }
  const userId = decodedState.userId;

This closes the account-takeover path where an attacker with any valid OAuth code could forge a state payload pointing to a victim's userId.

2. Replace Math.random() with crypto.randomBytes (auth.ts + connect.ts)

// Before
return Math.random().toString(36).substring(2, 15);

// After
return crypto.randomBytes(32).toString('hex'); // 256-bit CSPRNG

Applied to both generateState() functions. No logic change -- only the entropy source changes.

Why the preHandler approach works

The JWT is stored in an httpOnly token cookie (set at login). GitHub redirects the user's browser back to the callback URL, which carries all cookies, so app.authenticate can verify the session from the cookie in the same way as every other protected route.

Testing

1. Log in as User A.
2. Navigate to GET /api/connect/github -- redirects to GitHub.
3. Complete GitHub OAuth -- callback lands correctly and stores token under User A. (passes)
4. Attempt to replay with a forged state containing User B's userId while authenticated as User A -- server returns invalid_state. (blocked)

---

Draft -- waiting for assignment on #161 before review is requested.