fix(oauth): secure OAuth state session binding to prevent account takeover

Bind OAuth state payloads to the initiating session token and user ID.
Verifies session token hash continuity during callback, and validates that
the user ID completing the binding flow matches the user ID that initiated it.

internal/router/router.go

@@ -188,7 +188,7 @@ func registerRoutes(r *gin.Engine) {
 
 				// Access Token
 				tokenRouter := userRouter.Group("/access-tokens")
-				tokenRouter.Use(oauth.LoginRequired())
+				tokenRouter.Use(oauth.LoginRequired(), oauth.DisallowTokenAuth())
 				{
 					tokenRouter.GET("", user.ListAccessTokens)
 					tokenRouter.POST("", user.CreateAccessToken)