feat(pav-5): integrate Google OAuth login end-to-end

- Backend: fix callback to use req.session (shared with withSession
  middleware) instead of creating separate getIronSession instance,
  save userId in session, redirect to frontend instead of returning JSON
- Backend: add FRONTEND_URL env var for post-OAuth redirect
- Frontend: add getGoogleAuthUrl() to authService
- Frontend: wire Google button onClick in login and register pages
- Frontend: create AuthCallback page that detects session and
  navigates to /app
- Add AGENTS.md with project rules
- Add design spec and implementation plan docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

AGENTS.md

@@ -0,0 +1,5 @@
+# Regras do Projeto
+
+## Git
+
+- NUNCA faça commits automaticamente. Sempre pergunte ao usuario antes de commitar.

backend/.env.example

@@ -14,6 +14,9 @@ SESSION_SECRET=
 # CORS / frontend access (separar por vírgula)
 CORS_ALLOWED_ORIGINS=
 
+# URL do frontend (usada para redirect pos-OAuth)
+FRONTEND_URL=http://localhost:5173
+
 # LinkedIn search filters (defaults)
 SEARCH_LOCATION=Brasil
 SEARCH_GEO_ID=106057199

backend/src/modules/auth/auth.controller.ts

@@ -1,6 +1,5 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
-import { getIronSession } from "iron-session";
 import { z } from "zod";
 import {
   AuthCallbackParamsSchema,
@@ -9,40 +8,17 @@ import {
 
 import { AuthService } from "./auth.service.js";
 
-interface SessionData {
-  oauth_state?: string;
-  userId?: string;
-}
-
-const sessionOptions = {
-  password: process.env.SESSION_SECRET!,
-  cookieName: "vagas_session",
-
-  cookieOptions: {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    maxAge: 60 * 60 * 24 * 7,
-  },
-};
-
 export class AuthController {
   constructor(private readonly authService: AuthService) {}
 
   async getUrl(req: Request, res: Response) {
     try {
-      const session = await getIronSession<SessionData>(
-        req,
-        res,
-        sessionOptions,
-      );
-
       const provider = OAuthProviderSchema.parse(req.params.provider);
 
       const state = randomBytes(16).toString("hex");
 
-      session.oauth_state = state;
-
-      await session.save();
+      (req.session as any).oauth_state = state;
+      await req.session.save();
 
       const url = await this.authService.getAuthUrl(provider, state);
 
@@ -62,7 +38,7 @@ export class AuthController {
   }
 
   async callback(req: Request, res: Response) {
-    const session = await getIronSession<SessionData>(req, res, sessionOptions);
+    const frontendUrl = process.env.FRONTEND_URL || "http://localhost:5173";
 
     try {
       const callbackUrl = `${req.protocol}://${req.get("host")}${req.originalUrl}`;
@@ -74,42 +50,30 @@ export class AuthController {
         callbackUrl,
       });
 
-      if (!session.oauth_state) {
-        return res.status(400).json({
-          error: "OAuth state ausente",
-        });
+      const oauthState = (req.session as any).oauth_state;
+
+      if (!oauthState) {
+        return res.redirect(`${frontendUrl}/login?error=oauth_state_missing`);
       }
 
-      if (session.oauth_state !== params.state) {
-        return res.status(400).json({
-          error: "OAuth state inválido",
-        });
+      if (oauthState !== params.state) {
+        return res.redirect(`${frontendUrl}/login?error=oauth_state_invalid`);
       }
 
-      delete session.oauth_state;
-      await session.save();
+      delete (req.session as any).oauth_state;
 
       const result = await this.authService.handleCallback({
         ...params,
         callbackUrl,
       });
 
-      return res.json(result);
+      req.session.userId = result.session.userId;
+      await req.session.save();
+
+      return res.redirect(`${frontendUrl}/auth/callback`);
     } catch (error) {
       console.error("OAuth callback error:", error);
-
-      if (error instanceof z.ZodError) {
-        return res.status(400).json({
-          error: "Parâmetros de callback inválidos",
-          details: error.format(),
-        });
-      }
-
-      const message = error instanceof Error ? error.message : "Erro interno";
-
-      return res.status(500).json({
-        error: message,
-      });
+      return res.redirect(`${frontendUrl}/login?error=oauth_failed`);
     }
   }
 }