feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

app/api/auth/logout/route.js

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { axiosInstance } from "@/lib/req";
+import { clearRefreshCookie, COOKIE_NAME } from "@/lib/refreshCookie";
+
+export async function POST(request) {
+  const API_URL = process.env.NEXT_PUBLIC_API_URL;
+  const host = request.headers.get("host");
+  const refreshToken = request.cookies.get(COOKIE_NAME)?.value;
+
+  if (refreshToken) {
+    try {
+      await axiosInstance.post(
+        `${API_URL}/oauth/logout`,
+        { refresh_token: refreshToken },
+        { headers: { "Content-Type": "application/json", Authorization: "" } }
+      );
+    } catch {
+      // revoke best-effort; clearing the cookie below is what matters
+    }
+  }
+
+  const response = NextResponse.json({ success: true }, { status: 200 });
+  clearRefreshCookie(response, host);
+  return response;
+}