OAuth callback succeeds without authorization code

Bug

The OAuth callback route currently returns a successful response even when the callback request does not include an authorization code query parameter.

Reproduction

GET /api/auth/oauth/github/callback

Actual response:

{
  success: true,
  data: {
    provider: github,
    status: callback-received
  }
}

Expected behavior: the callback should reject requests that are missing the OAuth authorization code before reporting a successful callback.

Root cause

oauthCallback in apps/api/src/controllers/authController.js does not validate req.query.code and always returns success.

Proposed fix

Validate that code is a non-empty string before returning success. Missing, blank, or repeated code query values should return a 400 response.

Scope

This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information.

/bounty

Read apps/api/src/controllers/authController.js, starting at oauthCallback, and reproduce the callback request without a code query parameter. Verify that missing, blank, or repeated code values receive a 400 response, while a valid non-empty string does not return the current success response without validation.