[Agent] OAuth callback logs cookie names in production

Agent brief

Category: security | Severity: low | Effort: XS

OAuth callback logs cookie names. Remove or gate behind NODE_ENV=development.