fix(vikon): DNS bypass, OAuth callback, ABITUR init, token cache, ZIP security

- Add CURLOPT_RESOLVE DNS bypass for db-nica.ru / file.db-nica.ru
- Add OAuth callback route with CSRF state validation
- Add /authorize endpoint to generate OAuth URL with state
- Add ABITUR special case: init empty module core without ZIP download
- Add token validation caching (150s) to reduce API calls
- Block PHP/PHTML/PHAR files inside ZIP before extraction
- Add VikonTokenRefresh middleware for auto token refresh
- Add vikon.refresh middleware alias to Kernel

app/Containers/VikonIntegration/Tasks/HttpTask.php

@@ -60,9 +60,22 @@ class HttpTask
 
     private function client(): PendingRequest
     {
-        return Http::timeout($this->timeout)
+        $client = Http::timeout($this->timeout)
             ->retry($this->retries, 500)
             ->withHeaders(['Accept' => 'application/json']);
+
+        if (config('vikon.domain_resolve')) {
+            $client = $client->withOptions([
+                'curl' => [
+                    \CURLOPT_RESOLVE => [
+                        'db-nica.ru:443:' . config('vikon.vikon_domain_resolve_ip'),
+                        'file.db-nica.ru:443:' . config('vikon.fm_domain_resolve_ip'),
+                    ],
+                ],
+            ]);
+        }
+
+        return $client;
     }
 
     private function url(string $endpoint, string $service): string