Deploy: GitHub sign-in credentials, auth helper move, callback defaults

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

app/Actions/Auth/LoginAction.tsmodified+1-1

Changes to app/Actions/Auth/LoginAction.ts

		⋯3 linesShow the 3 lines above this hunk@@ -4,7 +4,7 @@ import { Auth, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/aut
4	4	import { User } from '@stacksjs/orm'
5	5	import { response } from '@stacksjs/router'
6	6	import { schema } from '@stacksjs/validation'
7		-import { buildAuthCookie, sessionExpiryMinutes } from './authCookie'
	7	+import { buildAuthCookie, sessionExpiryMinutes } from '../../Support/authCookie'
8	8
9	9	/**
10	10	* Email/password sign-in, registered at POST /api/auth/login (routes/auth.ts).

app/Actions/Auth/LogoutAction.tsmodified+1-1

Changes to app/Actions/Auth/LogoutAction.ts

		⋯1 lineShow the 1 line above this hunk@@ -2,7 +2,7 @@ import type { RequestInstance } from '@stacksjs/types'
2	2	import { Action } from '@stacksjs/actions'
3	3	import { Auth } from '@stacksjs/auth'
4	4	import { response } from '@stacksjs/router'
5		-import { clearAuthCookie } from './authCookie'
	5	+import { clearAuthCookie } from '../../Support/authCookie'
6	6
7	7	/**
8	8	* Project override of the framework's default LogoutAction — same token

app/Actions/Auth/RegisterAction.tsmodified+1-1

Changes to app/Actions/Auth/RegisterAction.ts

		⋯2 linesShow the 2 lines above this hunk@@ -3,7 +3,7 @@ import { Action } from '@stacksjs/actions'
3	3	import { Auth, register } from '@stacksjs/auth'
4	4	import { response } from '@stacksjs/router'
5	5	import { schema } from '@stacksjs/validation'
6		-import { buildAuthCookie } from './authCookie'
	6	+import { buildAuthCookie } from '../../Support/authCookie'
7	7
8	8	/**
9	9	* Account creation, registered at POST /api/auth/register (routes/auth.ts).

app/Actions/Auth/SocialCallbackAction.tsmodified+1-1

Changes to app/Actions/Auth/SocialCallbackAction.ts

		⋯5 linesShow the 5 lines above this hunk@@ -6,7 +6,7 @@ import { config } from '@stacksjs/config'
6	6	import { db } from '@stacksjs/database'
7	7	import { response } from '@stacksjs/router'
8	8	import { GitHubProvider, GoogleProvider } from '@stacksjs/socials'
9		-import { buildAuthCookie, sessionExpiryMinutes } from './authCookie'
	9	+import { buildAuthCookie, sessionExpiryMinutes } from '../../Support/authCookie'
10	10
11	11	function makeDriver(provider: string): GitHubProvider | GoogleProvider | null {
12	12	const svc = config.services as any

app/Actions/Auth/VerifyTwoFactorLoginAction.tsmodified+1-1

Changes to app/Actions/Auth/VerifyTwoFactorLoginAction.ts

		⋯2 linesShow the 2 lines above this hunk@@ -3,7 +3,7 @@ import { Action } from '@stacksjs/actions'
3	3	import { Auth, consumeTwoFactorChallenge, verifyTwoFactorLoginCode } from '@stacksjs/auth'
4	4	import { response } from '@stacksjs/router'
5	5	import { schema } from '@stacksjs/validation'
6		-import { buildAuthCookie, sessionExpiryMinutes } from './authCookie'
	6	+import { buildAuthCookie, sessionExpiryMinutes } from '../../Support/authCookie'
7	7
8	8	/**
9	9	* Exchange a LoginAction 2FA challenge + TOTP code for a real session,

config/auth.tsmodified+2-2

Changes to config/auth.ts

		⋯52 linesShow the 52 lines above this hunk@@ -53,7 +53,7 @@ export default {
53	53	* The custom auth actions (LoginAction, RegisterAction,
54	54	* VerifyTwoFactorLoginAction, SocialCallbackAction) mirror the issued
55	55	* access token into the HttpOnly `auth-token` cookie (see
56		- * Actions/Auth/authCookie.ts) because the dashboard is server-rendered stx
	56	+ * Support/authCookie.ts) because the dashboard is server-rendered stx
57	57	* with no client hydration and has no other way to know who is asking. Both
58	58	* the cookie's Max-Age and the `oauth_access_tokens.expires_at` row are
59	59	* stamped from here, and nothing extends either one — `getUserFromToken`
		⋯3 linesShow the 3 lines above this hunk@@ -63,7 +63,7 @@ export default {
63	63	*
64	64	* This is the BASELINE only. LoginAction and VerifyTwoFactorLoginAction
65	65	* pass a per-login `expiresInMinutes` from the sign-in form's "remember me"
66		- * checkbox (see sessionExpiryMinutes in Actions/Auth/authCookie.ts): a week
	66	+ * checkbox (see sessionExpiryMinutes in Support/authCookie.ts): a week
67	67	* unchecked, 30 days checked. This default covers the entry points that have
68	68	* no such checkbox — register, SSO — so they land on the baseline week.
69	69	*/

routes/auth.tsmodified+1-1

Changes to routes/auth.ts

		⋯7 linesShow the 7 lines above this hunk@@ -8,7 +8,7 @@ import { response, route } from '@stacksjs/router'
8	8	* prefix (config/server.ts). login.stx / register.stx are now client-fetch
9	9	* forms that POST here with `credentials: 'same-origin'`; on success each
10	10	* action returns a single HttpOnly `auth-token` cookie (see
11		- * Actions/Auth/authCookie.ts) that IS the session — there is no localStorage
	11	+ * Support/authCookie.ts) that IS the session — there is no localStorage
12	12	* token, no Authorization header and no refresh exchange anywhere.
13	13	*
14	14	* `.skipCsrf()` stays: the endpoints are same-origin fetches, and the cookie