Fix OAuth PKCE and security response hardening

[BigDella]

Summary

• Add Redis-backed Google OAuth PKCE state/verifier generation and callback code exchange validation
• Add allowlisted leaderboard sort handling across leaderboard/challenge routes
• Configure Referrer-Policy globally for API and web responses
• Strip production 5xx API responses down to a generic body with requestId

Validation

• set -a; source apps/api/.env.test; set +a; corepack pnpm exec vitest run --config apps/api/vitest.config.ts src/services/google-auth.test.ts src/routes/auth.test.ts src/routes/leaderboard.test.ts src/middleware/error.test.ts src/helmet.test.ts
• corepack pnpm exec vitest run --config apps/web/vitest.config.ts src/next-config.test.ts
• git diff --check

Closes privexlabs#500
Closes privexlabs#502
Closes privexlabs#503
Closes privexlabs#504