fix: harden auth, cron secrets, and provider flows (GNU-17) (#148)

- Replace === with crypto.timingSafeEqual in all 7 cron routes via shared lib/auth/cron.ts
- Add in-memory rate limiting (60 req/min) and expires_at support to calendar feed
- Add exponential backoff on MFA verify after 3 failed attempts
- Add 60s cooldown on password reset requests
- Validate bank callback auth code format before API call
- Redact session IDs from bank sync and callback logs
- Validate OAuth redirect_uris against allowlist (claude.ai, claude.com, localhost)
- Remove excessive PII/debug console logging from login page

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

supabase/migrations/20260329120000_calendar_feed_expiry.sql

@@ -0,0 +1,6 @@
+-- Add optional expiry to calendar feed tokens
+-- Null = no expiry (preserves existing tokens)
+ALTER TABLE calendar_feeds
+  ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ DEFAULT NULL;
+
+COMMENT ON COLUMN calendar_feeds.expires_at IS 'Optional token expiry. Null means the token never expires.';