feat: add webapp authentication endpoints

[TooAngel]

Summary

• Add GET /user/logout and GET /api/user/logout endpoints for webapp logout flow (proxy intercepts to clear httpOnly cookie)
• Add GET /api/auth/session endpoint to retrieve sessionId for httpOnly cookie setup
• Modify /login to accept ?redirect parameter for post-OAuth redirection back to webapp
• Modify /github-callback to redirect to stored URL or default /dashboard
• Mark POST /api/auth/logout as deprecated (replaced by GET endpoints)
• Document webapp integration pattern in code comments

Webapp Integration Flow

1. Webapp redirects browser to /login?redirect=<webapp-callback-url>
2. OAuth flow completes at /github-callback
3. User redirected back to webapp callback URL
4. Webapp calls GET /api/auth/session to get sessionId
5. Webapp sets sessionId as httpOnly cookie
6. Subsequent requests: proxy converts cookie to SESSION header

Test plan

• Verify existing OAuth flow still works (no redirect param → goes to /dashboard)
• Test new redirect parameter in /login
• Test /api/auth/session returns sessionId when authenticated
• Test GET /user/logout destroys session
• Verify POST /api/auth/logout still works (backwards compatibility)

[worlddriven]

🤖 Worlddriven Status

📊 Live Status Dashboard

🗓️ Merge Date: 2025-12-02 at 02:57:30 UTC (today)
📅 Started: 2025-11-30 at 07:22:52 UTC
⚡ Speed Factor: 0.18 (82% faster due to reviews)
✅ Positive votes: 302/369 contribution weight (coefficient: 0.82)
📈 Base Merge Time: 10 days → Current: 2 days

🎯 Want to influence when this merges?

Your review matters! As a contributor to this project, your voice helps determine the merge timeline.

How to review:

1. Check the changes
   

2. Leave your review
   

Your options:

• ✅ Agree & Speed Up: Approving makes this merge faster
• ❌ Disagree & Slow Down: Requesting changes delays the merge

💡 Pro tip: The more contributors who agree, the faster this gets merged!

📊 View detailed stats on the dashboard

📋 Recent Activity

• 2025-11-30, 07:23:00 - Pull request opened
• 2025-11-30, 07:23:02 - Pull request opened
• 2025-12-02, 03:52:07 - Pull request merged by worlddriven ✅

---

This comment is automatically updated by worlddriven