mobile2: Casdoor OIDC auth deployment

- New branch for mobile2.falah-os.com with Casdoor OIDC
- Auth page with 'Sign in with Casdoor' button
- OIDC callback: exchanges code via server-side API route
- env vars configured on Netlify
- DNS auto-configured via Netlify (falah-os.com zone)

src/app/auth/callback/page.tsx

@@ -13,6 +13,7 @@ function AuthCallbackContent() {
 
   useEffect(() => {
     const token = searchParams.get("token");
+    const code = searchParams.get("code");
     const error = searchParams.get("error");
 
     if (error) {
@@ -21,17 +22,62 @@ function AuthCallbackContent() {
       return;
     }
 
+    // --- Casdoor OIDC flow: exchange authorization code for tokens ---
+    if (code) {
+      fetch(`/api/auth/casdoor-callback?code=${encodeURIComponent(code)}`)
+        .then((res) => res.json())
+        .then((data) => {
+          if (data.error) {
+            setStatus("error");
+            setErrorMsg(data.error);
+            return;
+          }
+
+          // Store the access token
+          localStorage.setItem("flh_token", data.access_token);
+          if (data.id_token) {
+            localStorage.setItem("flh_id_token", data.id_token);
+          }
+          if (data.refresh_token) {
+            localStorage.setItem("flh_refresh_token", data.refresh_token);
+          }
+          if (data.user) {
+            localStorage.setItem("flh_user", JSON.stringify(data.user));
+          }
+
+          // Dispatch storage event so AuthContext picks it up
+          window.dispatchEvent(
+            new StorageEvent("storage", {
+              key: "flh_token",
+              newValue: data.access_token,
+              oldValue: null,
+              storageArea: localStorage,
+            })
+          );
+
+          setStatus("success");
+
+          // Redirect to home
+          setTimeout(() => router.push("/"), 500);
+        })
+        .catch((err) => {
+          console.error("[oidc-callback] Token exchange error:", err);
+          setStatus("error");
+          setErrorMsg("Failed to complete authentication. Please try again.");
+        });
+      return;
+    }
+
+    // --- Legacy UmmahID flow: token passed directly in URL ---
     if (!token) {
       setStatus("error");
-      setErrorMsg("No authentication token received.");
+      setErrorMsg("No authentication code received.");
       return;
     }
 
     // Store token in localStorage
     localStorage.setItem("flh_token", token);
 
-    // Dispatch a custom event so the AuthContext can pick it up
-    // (used by popup-based OAuth where the opener listens)
     window.dispatchEvent(
       new StorageEvent("storage", {
         key: "flh_token",
@@ -47,7 +93,6 @@ function AuthCallbackContent() {
     if (window.opener) {
       setTimeout(() => window.close(), 500);
     } else {
-      // Redirect to home
       setTimeout(() => router.push("/"), 500);
     }
   }, [searchParams, router]);