Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/dashboard-api/src/controllers/auth.controller.js`:
- Around line 101-107: Replace the raw Error throws in the response handling
blocks (the if (!response.ok) branch and the similar block at lines ~111-115)
with AppError instances: construct an AppError using the resolved message
(payload?.error_description || payload?.error || payload?.message ||
defaultMessage), set a suitable HTTP statusCode derived from response.status or
a default like 502, and include the original payload/response details as
non-sensitive context (e.g., in a meta/cause property) so controller error
middleware can handle it consistently; update imports to ensure AppError is
available in this file.
- Line 98: The fetch call allows options.signal to override the timeout
controller, so the timeout can be bypassed; change the argument order so the
controller's signal wins (pass options first and controller.signal last) when
calling fetch in the auth controller (the line with controller and options used
in the fetch call), and ensure you handle the case where options is undefined
before merging so the controller.signal is always applied.