feat: add GitHub OAuth2 login and protect product mutations with JWT

- add /auth/login and /auth/callback (rewritten to pages/api/auth/*) for the
  GitHub Authorization Code flow, with a state cookie against login CSRF
- issue a 1h JWT after the code exchange and verify it (HS256) in the Apollo
  context; createProduct, updateProduct and deleteProduct require it
- set products.created_by from the logged-in GitHub user (upsert into users)
- preset the Authorization header in the embedded Sandbox
- add jsonwebtoken, drop unused cors, rename package to week-7

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "week-4",
+  "name": "week-7",
   "version": "1.0.0",
   "description": "",
   "main": "index.js",
@@ -15,9 +15,9 @@
   "dependencies": {
     "@apollo/server": "^5.5.1",
     "@as-integrations/next": "^4.1.0",
-    "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "graphql": "^16.14.2",
+    "jsonwebtoken": "^9.0.3",
     "next": "^16.3.4",
     "pg": "^8.23.0",
     "react": "^19.2.8",