fix(auth): resolve login failures, add debug tracing and audit issues

[luisdlopera]

This PR resolves critical issues in the authentication flow that prevented users from logging in, while also providing a comprehensive audit report as requested.

Fixes implemented:

1. Bcrypt Timing Attack Error: Replaced a malformed dummy hash string with a valid bcrypt hash. Previously, logging in with a non-existent email threw a 500 error instead of failing silently.
2. Next.js BFF Token Validation Failure: The NestJS API was attempting to set its own auth cookies and omitting the refreshToken from the JSON response. This broke the Next.js Route Handler, which strictly expected both tokens in the JSON payload to manage cookies itself. NestJS now always returns the token.
3. Next.js Build Failure: Added a <Suspense> boundary around useSearchParams() inside the Auth page to prevent static prerendering crashes.

Audit & Tracing:

• Added [AUTH_DEBUG] logs across the frontend route handlers, frontend page components, backend controllers, and backend use-cases.
• Created three Markdown files in docs/issues/ formatted as GitHub issues, detailing the Critical, Security, and Architectural issues discovered during the audit.

---

PR created automatically by Jules for task 12038778990480496957 started by @luisdlopera

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.