feat: PKCE auth + CI/CD deploy

- Frontend: PKCE flow (oauth.ts, AuthCallback code exchange, 401 interceptor)
- Backend: token introspection via SuperOAuth (no more JWT secret)
- User model: superOauthId (unified) replaces oauthId+provider
- Cookies httpOnly session + refresh token
- POST /auth/refresh endpoint
- Gitea CI workflow (vps-runner pattern)
- DB_SYNC env var for initial schema creation

src/auth/auth.controller.ts

@@ -4,10 +4,11 @@ import {
   Get,
   Body,
   Res,
+  Req,
   UseGuards,
   HttpCode,
   HttpStatus,
-  Req,
+  UnauthorizedException,
 } from '@nestjs/common';
 import { Throttle } from '@nestjs/throttler';
 import { Response, Request } from 'express';
@@ -30,6 +31,20 @@ export class AuthController {
     return this.authService.setSession(dto, res);
   }
 
+  @Post('refresh')
+  @HttpCode(HttpStatus.OK)
+  @Throttle({ default: { ttl: 60_000, limit: 10 } })
+  async refresh(
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const refreshToken = (req.signedCookies as Record<string, string>)?.refresh_token;
+    if (!refreshToken) {
+      throw new UnauthorizedException('Pas de refresh token');
+    }
+    return this.authService.refreshSession(res, refreshToken);
+  }
+
   @Get('me')
   @UseGuards(AuthGuard)
   async getMe(@Req() req: Request & { user: User }) {