Fix: replace all settings.algorithm references with hardcoded ALGORITHM

SEC-11 removed algorithm from Settings but missed 3 call sites:
- auth.py line 68: jwt.decode in get_current_user
- integrations.py lines 58, 120: jwt.decode in OAuth callbacks

All now use ALGORITHM constant or inline 'HS256'.

backend/app/utils/auth.py

@@ -65,7 +65,7 @@ async def get_current_user(
 
     # Standard JWT validation
     try:
-        payload = jwt.decode(token, settings.secret_key, algorithms=[settings.algorithm])
+        payload = jwt.decode(token, settings.secret_key, algorithms=[ALGORITHM])
         user_id: str = payload.get("sub")
         if user_id is None:
             raise credentials_exception