fix: prevent unauthorized IDP linking via session validation

[JoseSzycho]

Description: This PR addresses a critical security vulnerability in the IDP linking flow by adding server-side session validation to prevent unauthorized account takeover.

Security Issue: Previously, a malicious user could potentially link their identity provider (e.g., Google, GitHub) to another user's account by manipulating the userId parameter during the OAuth callback flow. This would allow them to gain unauthorized access to the victim's account.

Fix: Added server-side validation in the IDP linking success handler that:

• Retrieves the authenticated user's session from secure HTTP-only cookies
• Verifies that the session user ID matches the target user ID for linking
• Rejects the linking attempt with "Access Denied" if there's a mismatch or missing session