feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

lib/serverToken.js

@@ -0,0 +1,19 @@
+import { cookies } from "next/headers";
+import { axiosInstance } from "@/lib/req";
+
+export async function getServerAccessToken() {
+  const cookieStore = await cookies();
+  const refreshToken = cookieStore.get("refresh_token")?.value;
+  if (!refreshToken) return null;
+
+  try {
+    const res = await axiosInstance.post(
+      `${process.env.NEXT_PUBLIC_API_URL}/oauth/token/refresh`,
+      { refresh_token: refreshToken },
+      { headers: { "Content-Type": "application/json", Authorization: "" } }
+    );
+    return res.data?.access_token ?? null;
+  } catch {
+    return null;
+  }
+}