fix(auth): update comments in AuthCallback and API client for clarity on token handling and refresh process

app/auth/callback/page.tsx

@@ -19,7 +19,8 @@ function AuthCallbackContent() {
     if (processedRef.current) return
     
     // * Check for direct token passing (from auth-frontend direct login)
-    // * TODO: This flow exposes tokens in URL, should be deprecated in favor of Authorization Code flow
+    // * This flow exposes tokens in URL, kept for legacy support.
+    // * Recommended: Use Authorization Code flow (below)
     const token = searchParams.get('token')
     const refreshToken = searchParams.get('refresh_token')
     

lib/api/client.ts

@@ -99,7 +99,7 @@ async function apiRequest<T>(
           isRefreshing = true
 
           try {
-            // * Call our internal Next.js API route to handle refresh securely
+            // * Call our Next.js API route to handle refresh securely
             const refreshRes = await fetch('/api/auth/refresh', {
               method: 'POST',
               headers: { 'Content-Type': 'application/json' },