- add /auth/login and /auth/callback (rewritten to pages/api/auth/*) for the
GitHub Authorization Code flow, with a state cookie against login CSRF
- issue a 1h JWT after the code exchange and verify it (HS256) in the Apollo
context; createProduct, updateProduct and deleteProduct require it
- set products.created_by from the logged-in GitHub user (upsert into users)
- preset the Authorization header in the embedded Sandbox
- add jsonwebtoken, drop unused cors, rename package to week-7
