feat: Sprint 1 core tracker + SuperOAuth PKCE E2E

Backend: cookie-parser, auth guard token introspection (SuperOAuth profile API),
fix réponse wrappée { success, data: { user, linkedProviders } }.
Frontend: page login 4 providers PKCE, callback SSR-safe (browser guard),
search améliorée (debounce, pagination, toast, feedback visuel ajout),
list complète (7 tabs, progression inline, score, vue grille/liste, cards goldées),
profil (XP bar, grades, 8 stats), user store partagé, toast system.

backend/src/auth/auth.guard.ts

@@ -42,7 +42,17 @@ export class AuthGuard implements CanActivate {
         headers: { Authorization: `Bearer ${token}` },
       });
       if (!res.ok) return null;
-      return res.json();
+      const body = await res.json();
+      if (!body?.success || !body?.data?.user) return null;
+
+      const user = body.data.user;
+      const avatar = body.data.linkedProviders?.[0]?.avatar || null;
+
+      return {
+        id: user.id,
+        nickname: user.nickname || user.email,
+        avatar,
+      };
     } catch {
       return null;
     }

backend/src/main.ts

@@ -1,10 +1,13 @@
 import { NestFactory } from '@nestjs/core';
 import { ValidationPipe } from '@nestjs/common';
+import cookieParser from 'cookie-parser';
 import { AppModule } from './app.module';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
 
+  app.use(cookieParser());
+
   app.enableCors({
     origin: process.env.FRONTEND_URL || 'http://localhost:5173',
     credentials: true,