feat(api): Implement API response Cache-Control

- Introduce `withCacheControl` utility function for API responses.
- Apply `private, no-store` to authentication and data modification (POST, PATCH, DELETE) routes.
- Apply `private, no-cache` to sensitive data retrieval (GET) routes.
- Enhance security by preventing caching of private user data.
- Ensure fresh data is always fetched for authenticated API responses.

app/api/auth/[...nextauth]/route.ts

@@ -1,5 +1,6 @@
 import { handlers } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
+import { withCacheControl } from '@/lib/api-response';
 
 export const { GET } = handlers;
 
@@ -8,5 +9,6 @@ export async function POST(request: Request) {
     const limited = await rateLimit(request, 'login');
     if (limited) return limited;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    return handlers.POST(request as any);
+    const response = await handlers.POST(request as any);
+    return withCacheControl(response, 'private, no-store');
 }

app/api/auth/register/route.ts

@@ -1,8 +1,8 @@
-import { NextRequest, NextResponse } from 'next/server';
+import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
 import bcrypt from 'bcryptjs';
 import { checkRateLimit, getClientIp, rateLimitHeaders, RATE_LIMIT_CONFIGS } from '@/lib/rate-limit';
-import { apiErrors, successResponse, ErrorCode } from '@/lib/api-response';
+import { apiErrors, successResponse, ErrorCode, withCacheControl } from '@/lib/api-response';
 
 export async function POST(request: NextRequest) {
     try {
@@ -95,7 +95,7 @@ export async function POST(request: NextRequest) {
             response.headers.set(key, value);
         });
 
-        return response;
+        return withCacheControl(response, 'private, no-store');
     } catch (error) {
         console.error('Registration error:', error);
         return apiErrors.internalError('Failed to create account');