feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

app/panel/(layout)/user-account/page.js

@@ -3,6 +3,7 @@ import { cookies } from "next/headers";
 import { fetchReq } from "@/lib/req";
 import { safeJsonParse } from "@/lib/sanitize";
 import { adaptBankAccount } from "@/lib/representationAdapters";
+import { getServerAccessToken } from "@/lib/serverToken";
 
 export const dynamic = "force-dynamic";
 
@@ -13,17 +14,19 @@ async function UserAccount() {
   try {
     const cookieStore = await cookies();
     const userInfo = cookieStore.get("userInfo");
-    const accessToken = cookieStore.get("access_token");
 
-    if (userInfo && accessToken) {
+    if (userInfo) {
       const parsedUserInfo = safeJsonParse(userInfo.value);
       const representationUuid = parsedUserInfo?.representation_uuid;
 
       if (representationUuid) {
-        representation = await fetchReq(
-          `${API_URL}/api/v1/representation/${representationUuid}`,
-          { headers: { Authorization: `Bearer ${accessToken.value}` } }
-        );
+        const accessToken = await getServerAccessToken();
+        if (accessToken) {
+          representation = await fetchReq(
+            `${API_URL}/api/v1/representation/${representationUuid}`,
+            { headers: { Authorization: `Bearer ${accessToken}` } }
+          );
+        }
       }
     }
   } catch (error) {