fix(logto): adicionar PKCE + rota /callback

- Logto EXIGE PKCE, sem isso retorna 400 invalid_request
- client.ts: restaura generatePkce() com crypto.subtle
- Adiciona /callback route + Callback.tsx que processa ?code=
- useAuth expõe handleCallback() no contexto
- nginx já tem fallback SPA, então /callback carrega index.html
  e React Router mostra a página de Callback

src/hooks/useAuth.tsx

@@ -28,6 +28,7 @@ export interface UseAuthReturn {
   signUp: (email: string, password: string) => Promise<{ error: unknown }>;
   signOut: () => Promise<void>;
   updatePassword: (password: string) => Promise<{ error: unknown }>;
+  handleCallback: () => Promise<boolean>;
 }
 
 const AuthContext = createContext<UseAuthReturn | undefined>(undefined);
@@ -92,6 +93,10 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     };
   }, []);
 
+  const handleCallbackFn = useCallback(async (): Promise<boolean> => {
+    return await handleCallback();
+  }, []);
+
   const value: UseAuthReturn = {
     user,
     loading,
@@ -101,6 +106,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     signUp,
     signOut,
     updatePassword,
+    handleCallback: handleCallbackFn,
   };
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;