feat(calendar): store only token hash in database to enhance security

feat(federation): escape LIKE special characters in originDomain to prevent wildcard injection

feat(oauth): redirect with token in hash fragment to avoid exposure in logs

feat(OAuthCallback): retrieve token from hash fragment for improved security

server/routes/oauth.js

@@ -248,9 +248,10 @@ router.get('/callback', callbackLimiter, async (req, res) => {
     // Generate JWT
     const token = generateToken(user.id);
 
-    // Redirect to frontend callback page with token
+    // Redirect to frontend callback page with token.
+    // Use a hash fragment so the token is never sent to the server (not logged, not in Referer headers).
     const returnTo = stateData.return_to || '/dashboard';
-    res.redirect(`${baseUrl}/oauth/callback?token=${encodeURIComponent(token)}&return_to=${encodeURIComponent(returnTo)}`);
+    res.redirect(`${baseUrl}/oauth/callback#token=${encodeURIComponent(token)}&return_to=${encodeURIComponent(returnTo)}`);
   } catch (err) {
     log.auth.error(`OAuth callback error: ${err.message}`);
     const baseUrl = getBaseUrl(req);