Phase 4 cleanup & polish: param migration seeds, gnexus-ui-kit LoginPage styles, single .env ...

- Replace raw string interpolation in migration with $tb->prepare() + execute()

- Remove all var(--color-*) from LoginPage.vue in favor of gnexus-ui-kit utility classes

- Unify .env: single server/.env, remove server/SHServ/.env override, update config.php

- Update auth-fix-plan.md: mark Phase 4 tasks complete

Phase 3 infrastructure hardening: IP/UA binding, nginx getallheaders fallback, auth rate limiting, permission cache

Phase 2 session stability: refresh queue, Bearer fallback, proactive refresh

Update auth-fix-plan: mark Phase 1 tasks completed

Phase 1 auth security hotfixes: cookie-based session, bearer checks, router guard sync ...

- Remove access_token from OAuth callback URL (token leak fix)
- Add sanitizeReturnTo() to prevent open redirect on login/callback
- Add Bearer token expiration check in resolve_user_by_bearer()
- Add user status check in load_user_by_id() (block inactive/banned)
- Cache authStore.init() promise to prevent race condition
- Await auth init in router beforeEach guard
- Remove URL token parsing from main.js and LoginPage
- Remove hasTokenInUrl workaround from client.js 401 handler