fix(connect): validate OAuth state nonce server-side to prevent CSRF (closes #223)

Replace client-side-only state validation in the GitHub connect flow with
server-side nonce verification backed by Redis.

- Generate a 32-byte cryptographically secure nonce on connect initiation
- Store {userId} in Redis under oauth:connect-nonce:<nonce> with a 10-minute TTL
- State parameter carries only the nonce; userId is never trusted from the callback
- On callback: validate nonce format, look up Redis, reject unknown/expired nonces
- Delete nonce immediately after first successful validation (replay protection)
- Drop Math.random()-based state generation in favour of randomBytes(32)
- Add 13 tests covering: valid flow, missing params, malformed state, unknown nonce,
  expired nonce, forged state, replay attack, corrupt Redis data, token exchange failure

Author: Ridanshi