feat: Sprint 1 core tracker + SuperOAuth PKCE E2E

Backend: cookie-parser, auth guard token introspection (SuperOAuth profile API),
fix réponse wrappée { success, data: { user, linkedProviders } }.
Frontend: page login 4 providers PKCE, callback SSR-safe (browser guard),
search améliorée (debounce, pagination, toast, feedback visuel ajout),
list complète (7 tabs, progression inline, score, vue grille/liste, cards goldées),
profil (XP bar, grades, 8 stats), user store partagé, toast system.

backend/src/auth/auth.guard.ts

@@ -42,7 +42,17 @@ export class AuthGuard implements CanActivate {
         headers: { Authorization: `Bearer ${token}` },
       });
       if (!res.ok) return null;
-      return res.json();
+      const body = await res.json();
+      if (!body?.success || !body?.data?.user) return null;
+
+      const user = body.data.user;
+      const avatar = body.data.linkedProviders?.[0]?.avatar || null;
+
+      return {
+        id: user.id,
+        nickname: user.nickname || user.email,
+        avatar,
+      };
     } catch {
       return null;
     }