Mobile: add per-login state and strict auth callback validation

[NeerajCodz]

Motivation

• Fix a high-severity auth flow vulnerability where the mobile app accepted bearer tokens from a custom-scheme callback without state/origin binding, allowing token injection or interception.
• Implement minimal, low-risk hardening to ensure a callback is tied to the originating login transaction before storing tokens.

Description

• Added AUTH_STATE_BYTES and createAuthState() to generate a cryptographically-random per-login state value.
• Added validateCallbackUrl(callbackUrl, expectedState) that validates scheme, host, path, and the state parameter before returning tokens.
• Updated the auth request to include the generated state and to only persist tokens to SecureStore after validateCallbackUrl succeeds.
• Changes are localized to apps/mobile/app/login.tsx and preserve existing token persistence and routing behaviour after validation.

Testing

• Ran a focused Node harness that exercised validateCallbackUrl and verified valid callbacks are accepted and mismatched-state or wrong-callback-host cases are rejected (success).
• Ran git diff --check to ensure no whitespace/patch issues (success).
• Ran tsc for the mobile project (bunx tsc -p apps/mobile/tsconfig.json --noEmit) which failed due to missing Expo/mobile dev dependencies and expo/tsconfig.base in this environment (environment limitation, not a code regression).

---

Codex Task