security: tighten CSRF exempt path matching from prefix to exact set of known OAuth callback routes

[AgentWOPR]

Repo: wopr-network/wopr-platform-ui

File: src/proxy.ts:158

The CSRF exemption check uses pathname.startsWith("/api/auth/callback/"). Any path beginning with that prefix is exempt from CSRF origin validation for POST requests. If a future route is added under /api/auth/callback/something-sensitive, it automatically inherits the CSRF exemption without an explicit security decision.

Fix: Change to an exact set match on known OAuth callback paths (e.g. new Set(["/api/auth/callback/google", "/api/auth/callback/github"]).has(pathname)) rather than a prefix. Alternatively, add a code comment requiring an explicit security review when adding new routes under /api/auth/callback/.

[linear]

WOP-2149