fix: harden auth, cron secrets, and provider flows (GNU-17) (#148)

- Replace === with crypto.timingSafeEqual in all 7 cron routes via shared lib/auth/cron.ts
- Add in-memory rate limiting (60 req/min) and expires_at support to calendar feed
- Add exponential backoff on MFA verify after 3 failed attempts
- Add 60s cooldown on password reset requests
- Validate bank callback auth code format before API call
- Redact session IDs from bank sync and callback logs
- Validate OAuth redirect_uris against allowlist (claude.ai, claude.com, localhost)
- Remove excessive PII/debug console logging from login page

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/invoices/reminders/cron/route.ts

@@ -1,34 +1,11 @@
 import { NextResponse } from 'next/server'
 import { processOverdueReminders } from '@/lib/invoices/reminder-processor'
 import { getEmailService } from '@/lib/email/service'
-
-// Verify cron secret for security
-function verifyCronSecret(request: Request): boolean {
-  const authHeader = request.headers.get('authorization')
-  const cronSecret = process.env.CRON_SECRET
-
-  if (!cronSecret) {
-    console.error('CRON_SECRET not configured')
-    return false
-  }
-
-  if (!authHeader) {
-    return false
-  }
-
-  // Support both "Bearer <token>" and just "<token>" formats
-  const token = authHeader.startsWith('Bearer ')
-    ? authHeader.substring(7)
-    : authHeader
-
-  return token === cronSecret
-}
+import { verifyCronSecret } from '@/lib/auth/cron'
 
 export async function GET(request: Request) {
-  // Verify cron authentication
-  if (!verifyCronSecret(request)) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
+  const authError = verifyCronSecret(request)
+  if (authError) return authError
 
   // Check if email service is configured
   if (!getEmailService().isConfigured()) {