Add secure auth code exchange for LinkedIn OAuth

[rxmox]

Summary

• Replace direct JWT token in LinkedIn OAuth redirect URL with a single use auth code pattern
• Add AuthCode MongoDB model with 60-second TTL auto expiry
• Add POST /api/auth/exchange endpoint to exchange auth code for JWT token
• Prevents token exposure in browser history and URLs

Changes

• src/models/auth_code_model.ts (new): AuthCode schema with unique index and 60s TTL
• src/controllers/auth_controller.ts: LinkedIn callback now generates a temp auth code instead of returning JWT in redirect; added exchangeAuthCode controller
• src/routes/auth_routes.ts: Register POST /exchange route

Testing done

All tests performed manually against local dev server (npm run dev):

• Missing code → 400: POST /api/auth/exchange with empty body returns {"error": "Auth code is required"}
• Invalid code → 401: POST /api/auth/exchange with {"code": "fakecode123"} returns {"error": "Invalid or expired auth code"}
• Full LinkedIn OAuth flow: Logged in via GET /api/auth/linkedin, confirmed redirect URL contains only code param (no token/userId), exchanged the code via POST /api/auth/exchange and received {"message": "Authentication successful", "userId": "...", "token": "..."}
• Single-use verification: Reusing the same auth code returns {"error": "Invalid or expired auth code"} (confirmed atomic delete on first use)
• Build: npm run build passes with no TypeScript errors