fix: return proper token response from casdoor-callback API route + remove hardcoded secret

next.config.ts

@@ -12,6 +12,16 @@ const nextConfig: NextConfig = {
   turbopack: {
     root: path.resolve(import.meta.dirname || __dirname),
   },
+  async redirects() {
+    return [
+      {
+        source: "/auth/callback",
+        destination: "/mobile/auth/callback",
+        permanent: false,
+        basePath: false,
+      },
+    ];
+  },
 };
 
 export default nextConfig;