fix(vikon): DNS bypass, OAuth callback, ABITUR init, token cache, ZIP security

- Add CURLOPT_RESOLVE DNS bypass for db-nica.ru / file.db-nica.ru
- Add OAuth callback route with CSRF state validation
- Add /authorize endpoint to generate OAuth URL with state
- Add ABITUR special case: init empty module core without ZIP download
- Add token validation caching (150s) to reduce API calls
- Block PHP/PHTML/PHAR files inside ZIP before extraction
- Add VikonTokenRefresh middleware for auto token refresh
- Add vikon.refresh middleware alias to Kernel

app/Containers/VikonIntegration/Tasks/ValidateTokenTask.php

@@ -2,6 +2,7 @@
 
 namespace App\Containers\VikonIntegration\Tasks;
 
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Log;
 
 class ValidateTokenTask
@@ -13,13 +14,23 @@ class ValidateTokenTask
 
     public function run(string $accessToken): bool
     {
+        $cacheKey = 'vikon_token_' . md5($accessToken);
+        $cached = Cache::get($cacheKey);
+
+        if ($cached !== null) {
+            return $cached;
+        }
+
         try {
             $response = $this->http->post('oauth2/resource/token/introspect', [
                 'client_id'    => $this->clientId,
                 'access_token' => $accessToken,
             ]);
 
-            return $response->successful();
+            $valid = $response->successful();
+            Cache::put($cacheKey, $valid, now()->addSeconds(150));
+
+            return $valid;
         } catch (\Throwable $e) {
             Log::warning('Vikon token validation failed', ['error' => $e->getMessage()]);
             return false;