Problem

Few lines in apps/backend/src/routes/auth.ts call console.log with the full OAuth redirect URL, which includes the
state token. State tokens are CSRF protection secrets and must not appear in logs. This also bypasses Fastify's pino logger,
breaking structured logging and level-based filtering in production. All other paths in the codebase correctly use app.log.error.

Fix

• Removed all 4 console.log lines from the /github and /google handlers
• Replaced with app.log.debug({ provider: '...' }, 'OAuth redirect initiated')
• No URL or state token is logged
• Uses Fastify's pino logger consistently with the rest of the codebase

Testing

• Existing test suite passes
• console.log is no longer called during OAuth initiation

Closes #202