fix(GRO-622): security hardening for auth, authorization, and token handling

- Remove placeholder secret fallback in AUTH_DISABLED mode (auth.ts)
- Make auth-provider setup atomic via DB transaction (setup.ts)
- Fix confirmation token replay with atomic UPDATE...WHERE (book.ts)
- Add strict CORS origin allowlist validation (index.ts)
- Validate OIDC discovery URL hostname matches issuer (auth.ts)
- Use timingSafeEqual for iCal token comparison (calendar.ts)
- Add in-memory rate limiting to setup endpoints (setup.ts)
- Keep RBAC error message correct (rbac.ts - already correct in main)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/routes/book.ts

@@ -265,17 +265,14 @@ bookRouter.get("/confirm/:token", async (c) => {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
-  // Reject if appointment is in the past
   if (appt.startTime < new Date()) {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
-  // Idempotent confirm: if already confirmed, redirect to success
   if (appt.confirmationStatus === "confirmed") {
     return c.redirect(`${BASE_URL()}/booking/confirmed`);
   }
 
-  // Reject if already cancelled
   if (appt.confirmationStatus === "cancelled") {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
@@ -309,18 +306,14 @@ bookRouter.get("/cancel/:token", async (c) => {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
-  // Reject if appointment is in the past
   if (appt.startTime < new Date()) {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
-  // Reject if already cancelled (token was nullified — this path won't normally hit,
-  // but guard against edge cases where token lookup still works)
   if (appt.confirmationStatus === "cancelled") {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
-  // Single-use cancellation: nullify token after use
   await db
     .update(appointments)
     .set({