feat: Implement HttpOnly cookies for access and refresh tokens in authentication routes

[kemalcalak]

Note

Medium Risk
Changes authentication token transport (response bodies/headers to HttpOnly cookies) and request authentication behavior, which can break existing clients and impacts security assumptions (cookie handling/CSRF posture). Scope is contained to auth routes, auth dependency, and tests.

Overview
Authentication now primarily uses HttpOnly cookies instead of returning access_token in JSON responses.

POST /auth/login and POST /auth/refresh set/rotate the access_token cookie (and login still sets refresh_token scoped to the refresh path), while responses switch to CookieLoginResponse/CookieRefreshResponse that omit the access token. POST /auth/logout now clears both access_token and refresh_token cookies.

Request authentication (get_current_user) now reads the JWT from the access_token cookie first and falls back to an Authorization: Bearer header (via OAuth2PasswordBearer(auto_error=False)), and tests are updated to assert cookies and rely on the client cookie jar rather than manually setting auth headers.

^{Written by Cursor Bugbot for commit 4f1a664. This will update automatically on new commits. Configure here.}

[kemalcalak]

@cursor review

[kemalcalak]

@cursor review

[kemalcalak]

@cursor review

[kemalcalak]

@cursor review

[kemalcalak]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

LoginResponse class is now unused dead code

Low Severity

The LoginResponse class was replaced by CookieLoginResponse in the auth routes, but its definition was left behind in token.py. A grep confirms it is no longer imported or referenced anywhere in the codebase, making it dead code.