Login via OIDC (BFF Auth.js). Tokens ficam só no servidor.
AUTH_MODE=oidc · BFF no Next · API resource server