feat: add @constructive-io/oauth and @constructive-io/csrf packages

[pyramation]

Summary

Adds two new authentication/security packages to the Constructive monorepo:

@constructive-io/csrf - Lightweight CSRF protection for Express applications

• Token generation with cryptographically secure random bytes
• Timing-safe token verification to prevent timing attacks
• Express middleware implementing the double-submit cookie pattern
• Support for both form submissions and AJAX/fetch requests
• 22 unit tests

@constructive-io/oauth - Minimal OAuth 2.0 client for social authentication

• Supports Google, GitHub, Facebook, and LinkedIn providers
• Core OAuth client for generating authorization URLs, exchanging codes for tokens, and fetching user profiles
• Express middleware with route handlers for /auth/:provider and /auth/:provider/callback
• Normalized user profile format across all providers
• Depends on @constructive-io/csrf for state parameter management
• 25 unit tests

No external auth library dependencies (no Passport, NextAuth, or Better Auth). As requested, this PR only includes the fetching/middleware logic - no database/SQL integration.

Review & Testing Checklist for Human

• Verify OAuth provider endpoints are correct - The authorization URLs, token URLs, and userinfo URLs for each provider are hardcoded. Please verify these match current provider documentation (especially LinkedIn which recently changed their API)
• Test actual OAuth flow with at least one provider - Unit tests only cover URL generation and profile mapping, not the actual token exchange or profile fetching. Recommend testing with Google or GitHub using real credentials
• Test CSRF middleware integration - Verify the CSRF middleware works correctly with your Express setup (form submissions and AJAX requests)
• Review Express middleware type compatibility - Both packages use custom request/response type definitions rather than importing from @types/express. Verify this integrates correctly with your Express setup
• Review cookie security settings - Both packages set cookies with httpOnly: true, sameSite: 'lax', and secure only in production. Confirm these settings match your security requirements

Recommended test plan:

1. Install both packages in a test Express app
2. Configure CSRF middleware and verify form/AJAX protection works
3. Configure OAuth with at least one provider (Google recommended) and complete a full login flow

Notes

• The GitHub provider has special handling to fetch emails from /user/emails endpoint if email is not returned in the main profile response
• 47 total unit tests pass (25 OAuth + 22 CSRF)
• The large diff in pnpm-lock.yaml is formatting changes only (multi-line to single-line resolution objects)

Link to Devin run: https://app.devin.ai/sessions/c1125b60da1f442d98324962c71ca06e
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring