v1.2.1

• Fix: Disambiguated session OAuth fields — added providerConfigId and providerType alongside existing provider to clarify config key vs provider type (#26)
• Fix: Provider errors (e.g. GitHub 500 HTML pages) no longer leak raw response bodies to the browser — callback redirects with ?error=auth_failed&reason=token_exchange instead
• Security: Open redirect prevention on all callback redirect paths (error and success) via sanitizeRedirect()
• Security: Error reason codes in redirect URLs use safe constants instead of raw error messages
• Fix: Response bodies drained in error paths to prevent undici socket/connection pool leaks
• Fix: Error redirect URLs correctly place query params before hash fragments via buildErrorRedirect() helper
• Fix: JSON parse failures in token exchange/refresh fall back gracefully to status code instead of crashing