Fix/oauth jwt cookie - #153

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/utils/helper.ts`:
- Around line 12-13: The token extraction logic in extractToken is too
permissive because it accepts any Authorization header with a second segment and
lets it override the cookie; update it so only a Bearer authorization header is
used before falling back to parseCookie(req.headers.cookie, 'token'). Keep the
existing extractToken behavior otherwise, but add an explicit scheme check in
the authorization parsing path so Basic and other non-Bearer headers do not
block a valid cookie token.

In `@src/validators/auth.validator.ts`:
- Around line 10-13: The SignupSchema name field currently uses
z.string().min(1), which still allows whitespace-only values to pass through
parsed.data.name. Update the name validator in SignupSchema to trim the input
before applying the requiredness check, so blank display names are rejected
consistently while keeping the existing validation message behavior.

In `@tests/auth.middleware.test.ts`:
- Around line 58-76: The invalid-cookie test is mocking JwtVerify with a plain
Error, which does not match the real verification failure shape used by
authGuard and handleAuthError. Update the test in auth.middleware.test.ts to
simulate the actual jwt.JsonWebTokenError contract from src/middlewares/jwt.ts
so the authGuard path is exercised as production handles it, and keep the
assertions aligned with the Unauthorized: Invalid token mapping.

---

Nitpick comments:
In `@src/validators/auth.validator.ts`:
- Around line 3-14: Update the Zod validators in LoginSchema and SignupSchema to
use Zod 4’s documented { error: ... } option instead of positional string
messages. Replace the current string arguments on email() and min() with the
unified error form for all four field validators so the auth schema definitions
align with the newer API and avoid legacy overloads.