fix: add PKCE to OAuth checks and HTTP security response headers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/auth.ts

@@ -89,7 +89,7 @@ function createOAuthProviders(): OAuthConfig<any>[] {
       authorization: config.oauth.authorizationUrl ?? undefined,
       token: config.oauth.tokenUrl ?? undefined,
       userinfo: config.oauth.userinfoUrl ?? undefined,
-      checks: ["state"],
+      checks: ["pkce", "state"],
       profile(profile) {
         return {
           id: profile.sub ?? profile.id,