fix(vikon): DNS bypass, OAuth callback, ABITUR init, token cache, ZIP security

- Add CURLOPT_RESOLVE DNS bypass for db-nica.ru / file.db-nica.ru
- Add OAuth callback route with CSRF state validation
- Add /authorize endpoint to generate OAuth URL with state
- Add ABITUR special case: init empty module core without ZIP download
- Add token validation caching (150s) to reduce API calls
- Block PHP/PHTML/PHAR files inside ZIP before extraction
- Add VikonTokenRefresh middleware for auto token refresh
- Add vikon.refresh middleware alias to Kernel

app/Http/Middleware/VikonTokenRefresh.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Containers\VikonIntegration\Tasks\RefreshTokenTask;
+use App\Containers\VikonIntegration\Tasks\ValidateTokenTask;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Session;
+
+class VikonTokenRefresh
+{
+    public function handle(Request $request, Closure $next)
+    {
+        $token = Session::get('vikon_access_token');
+        $refreshToken = Session::get('vikon_refresh_token');
+
+        if ($token && $refreshToken) {
+            $validate = app(ValidateTokenTask::class);
+
+            if (!$validate->run($token)) {
+                try {
+                    $tokens = app(RefreshTokenTask::class)->run($refreshToken);
+                    Session::put('vikon_access_token', $tokens['access_token']);
+                    Session::put('vikon_refresh_token', $tokens['refresh_token']);
+                } catch (\Throwable $e) {
+                    Log::warning('Vikon auto-refresh failed', ['error' => $e->getMessage()]);
+                    Session::forget(['vikon_access_token', 'vikon_refresh_token']);
+                }
+            }
+        }
+
+        return $next($request);
+    }
+}