feat: add GitHub OAuth2 login and protect product mutations with JWT

- add /auth/login and /auth/callback (rewritten to pages/api/auth/*) for the
  GitHub Authorization Code flow, with a state cookie against login CSRF
- issue a 1h JWT after the code exchange and verify it (HS256) in the Apollo
  context; createProduct, updateProduct and deleteProduct require it
- set products.created_by from the logged-in GitHub user (upsert into users)
- preset the Authorization header in the embedded Sandbox
- add jsonwebtoken, drop unused cors, rename package to week-7

next.config.js

@@ -0,0 +1,9 @@
+module.exports = {
+  // Lab 07 memakai URL /auth/login dan /auth/callback (tanpa prefix /api).
+  rewrites() {
+    return [
+      { source: '/auth/login', destination: '/api/auth/login' },
+      { source: '/auth/callback', destination: '/api/auth/callback' },
+    ];
+  },
+};