fix(oauth): secure OAuth state session binding to prevent account takeover

Bind OAuth state payloads to the initiating session token and user ID.
Verifies session token hash continuity during callback, and validates that
the user ID completing the binding flow matches the user ID that initiated it.

internal/apps/oauth/middlewares.go

@@ -101,3 +101,15 @@ func LoginRequired() gin.HandlerFunc {
 		c.Next()
 	}
 }
+
+// DisallowTokenAuth 拒绝使用 Access Token 进行身份验证的请求访问该端点
+func DisallowTokenAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if tokenAuth, _ := util.GetFromContext[bool](c, TokenAuthKey); tokenAuth {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error_msg": TokenAuthNotAllowed, "data": nil})
+			return
+		}
+		c.Next()
+	}
+}
+