fix: harden OAuth identity and cookies and correct quota and JSON display

apps/aether-gateway/src/handlers/public/support.rs

@@ -30,6 +30,8 @@ use std::time::{SystemTime, UNIX_EPOCH};
 mod support_announcements;
 #[path = "support/auth.rs"]
 mod support_auth;
+#[path = "support/auth_cookie_policy.rs"]
+mod support_auth_cookie_policy;
 #[path = "support/billing.rs"]
 mod support_billing;
 #[path = "support/ccswitch.rs"]
@@ -133,6 +135,31 @@ pub(crate) async fn maybe_build_local_public_support_response(
     remote_addr: &std::net::SocketAddr,
     client_ip: std::net::IpAddr,
     request_body: Option<&Bytes>,
+) -> Option<Response<Body>> {
+    let response = build_local_public_support_response(
+        state,
+        request_context,
+        headers,
+        remote_addr,
+        client_ip,
+        request_body,
+    )
+    .await?;
+    Some(support_auth_cookie_policy::finalize_refresh_cookie(
+        response,
+        headers,
+        request_context.host_header.as_deref(),
+        remote_addr,
+    ))
+}
+
+async fn build_local_public_support_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    headers: &http::HeaderMap,
+    remote_addr: &std::net::SocketAddr,
+    client_ip: std::net::IpAddr,
+    request_body: Option<&Bytes>,
 ) -> Option<Response<Body>> {
     let decision = request_context.control_decision.as_ref()?;
     if decision.route_class.as_deref() != Some("public_support") {