refactor(core): share the console proxy path checks across adapters #189

Summary

The console proxy's path checks are copied into three adapters:

• packages/express/src/consoleProxy.ts
• packages/fastify/src/consoleProxy.ts
• packages/nextjs/src/consoleProxy.ts (added in feat(nextjs): serve the admin console from a Next.js application #187)

Each copy has its own normalizeBasePath, resolveUpstreamUrl, and FORWARDED_RESPONSE_HEADERS. Fastify and Next.js also each have a stripMountPath. These checks are what keep the proxy inside the console subtree: they refuse encoded %2f/%5c and any resolved path outside the upstream prefix. A fix to one copy has to be made in all three by hand, and a missed copy is a traversal hole in one adapter only.

Proposal

Move the framework-agnostic parts into @seamless-auth/core:

• normalizeBasePath
• resolveUpstreamUrl (encoded-separator rejection plus the prefix check)
• the forwarded response header allowlist

Each adapter keeps only what depends on its framework: how it gets the raw path (Express req.path, Fastify's raw request.url minus the prefix, the Next.js Request URL minus mountPath), and how it writes the response.

stripMountPath could move too, but the Fastify and Next.js versions differ slightly (Fastify's falls back to / for an empty remainder after a prefix match, the Next.js one requires an exact match or a / boundary). Reconcile them or keep them local.

Acceptance

• The three adapters import the shared helpers from core, and no copy is left in an adapter.
• Unit tests for the shared helpers in packages/core/tests.
• The existing console proxy tests and parity suites pass unchanged.
• No change to the adapters' public API, so this needs only a patch changeset.