feat: connect Next.js frontend to ASP.NET Core backend with CORS and OAuth

[Copilot]

Wires up the GitQuest frontend and backend end-to-end: CORS policy, GitHub OAuth callback, HttpOnly JWT cookie storage, and a typed fetch wrapper for all API endpoints.

Backend

• CORS — reads allowed origins from AllowedOrigins[] in config (env-var overridable via AllowedOrigins__0=https://...); adds AllowCredentials(); throws at startup in production if origins are still set to localhost
• Auth route alias — AuthController now also handles POST /api/auth/github alongside the existing github-login route

// appsettings.json
"AllowedOrigins": ["http://localhost:3000"]

Frontend

• lib/api.ts — typed ApiResponse<T> fetch wrapper; no thrown exceptions; covers all five endpoints (loginWithGitHub, discoverIssues, claimIssue, getMyQuests, submitQuest)
• lib/auth.ts — JWT stored in HttpOnly cookie (server-side only); non-sensitive user info in a separate readable cookie for client components; helpers for set/clear/read
• app/api/auth/callback/github/route.ts — OAuth code → backend exchange → HttpOnly cookie → redirect to /discover; error messages are sanitized before surfacing to the user
• app/api/auth/logout/route.ts — clears both cookies server-side
• next.config.mjs — exposes NEXT_PUBLIC_API_BASE_URL (fallback: http://localhost:5198)

Environment variable docs

• frontend/.env.example — NEXT_PUBLIC_API_BASE_URL, NEXT_PUBLIC_GITHUB_CLIENT_ID
• Backend/.env.example — connection string, JWT settings, GitHub OAuth, CORS origins using ASP.NET Core's __ separator syntax

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/GitQuest/GitQuest/frontend/node_modules/.bin/next build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.