feat!: implement security improvements for authentication

[VanessaBizzell]

Summary

• URL encoding: Email and code parameters in login links are now URL-encoded to handle special characters (e.g., + in emails)
• Input validation: LoginStep1SendVerificationCode now validates returnUrl against allowed list
• POST for refresh: /auth/refresh changed from GET to POST with JSON body (breaking change)
• httpOnly cookies: Tokens now delivered via secure httpOnly cookies instead of response body (breaking change)
• CSRF protection: New CSRFMiddleware and SetCSRFCookie helper for state-changing requests
• Logout endpoint: New POST /auth/logout to clear token cookies
• Cookie auth in middleware: VerifyAuthenticationToken now supports both Authorization header and cookie-based auth
• Go 1.26: Upgraded from Go 1.22 to Go 1.26

Breaking Changes

This is a major version release (v3.0.0). Consumers must update their code:

1. Refresh endpoint: GET /auth/refresh?token=xxx → POST /auth/refresh with {"token": "xxx"}
2. Token handling: Tokens returned as cookies, not in response body
3. Frontend changes: Add credentials: 'include' to fetch calls, add X-CSRF-Token header for POST/PUT/DELETE
4. Go version: Requires Go 1.26+

Test plan

• 37 new unit tests covering all security features
• Manual integration testing with REST client (login → confirm → protected → CSRF-protected action)
• Test in consumer project (Launch Saviour)

🤖 Generated with Claude Code