fix: resolve audit issues for v2 release

[soymgomez]

Summary

Resolves all issues found during the security and code quality audit. This PR prepares the package for the v1 → v2 major release.

Security

• Encrypt OAuth tokens at rest — Added encrypted cast to oauth_token and oauth_refresh_token in the Eloquent model. Tokens are now encrypted/decrypted transparently via Laravel's Crypt.
• Session fixation — Added Session::regenerate() before Auth::guard()->login() in the OAuth callback.
• Null check on groups — $callback['groups'] ?? [] in all 3 places to prevent errors when the OAuth provider does not return groups.
• Rate limiting — Added throttle:5,1 middleware to OAuth routes.

Bug fixes

• Middleware ignoring redirect — OAuthTokenRenewal now captures and returns the redirect response from renew() instead of silently discarding it.
• Broken facade — Fixed accessor to return 'oauth' string, singleton now resolves OAuthService, deleted dead src/OAuth.php.
• Encrypt command bug — Fixed continue that skipped entire records when oauth_token was already encrypted, leaving oauth_refresh_token unencrypted. Each field is now evaluated independently.
• Regex injection in command — Added preg_quote() when building regex from env variable keys.
• Relative path in command — Changed to config_path('oauth.php').
• Config comments — Fixed copy-paste descriptions for guard_name, login_route_name, redirect_route_name_callback_ok.
• Config default — Changed user_model_name default from test class to App\Models\User.
• PHPStan type errors — Fixed mixed concatenation in OAuthService, @var type mismatches in OAuthCommand and OAuthController.

Upgrade path (v1 → v2)

• New alter migration (upgrade_oauth_table_v2) — Changes oauth_refresh_token to longText, oauth_token_expires_at to unsignedBigInteger, adds index on oauth_id. Original create_oauth_table migration preserved for existing installations.
• oauth:encrypt-tokens command — Encrypts existing plaintext tokens in-place, skips already encrypted values, safe to re-run.
• Deprecated event alias — EventsOAuthTokenUpdated now extends OAuthTokenUpdated as a deprecated alias (will be removed in v3).
• UPGRADE.md — Documents all breaking changes and step-by-step migration guide with maintenance mode.

Code quality

• Constructor property promotion in OAuthController (removed nullable + service locator fallback).
• Request injection — Replaced Request facade with Illuminate\Http\Request injection in callback().
• Event rename — EventsOAuthTokenUpdated → OAuthTokenUpdated.
• Variable naming — $valorFormateado → $formattedValue.
• Typo fix — "loged" → "logged" in interface and handler.
• Simplified belongsTo — (new $model())::class → $model directly.
• Removed dead code — src/OAuth.php, loadMigrations() method.

Breaking changes

• Dropped Laravel 10 support — Laravel 10 reached EOL in Feb 2025. This avoids requiring doctrine/dbal for migration ->change() calls.
• Constructor signature of OAuthController changed (required params, no more nullable fallback).
• src/OAuth.php removed — Use Raiolanetworks\OAuth\Facades\OAuth instead.
• Rate limiting added to OAuth routes (throttle:5,1).

CI / DevOps

• Updated test matrix — Dropped Laravel 10, added Laravel 12 with testbench ^10.0.
• Updated dev dependencies — larastan ^2.0|^3.0, orchestra/testbench ^9.4|^10.0, nunomaduro/collision ^8.1.1.
• PHPStan config — Added ignore for env() false positive in config files (larastan v3 rule), set reportUnmatchedIgnoredErrors: false for cross-version compat.
• Fixed prefer-lowest — CI matrix now uses ^9.4/^10.0 instead of 9.*/10.* to respect minimum testbench versions.

Test plan

• All 24 tests passing (75 assertions)
• PHPStan — no errors (compatible with both larastan v2 and v3)
• Pint — no formatting issues
• CI green: L11 + L12, PHP 8.2 + 8.3, prefer-lowest + prefer-stable (8 jobs)
• Encrypt command tested: plaintext encryption, skip already encrypted, partial encryption, empty table
• Deprecated event alias tested: EventsOAuthTokenUpdated is instance of OAuthTokenUpdated
• Middleware tested: redirect response returned, null response passes through