server: Valkey adapter for OidcAuthorizationStore and Postgres adapter for FederatedAccounts

[justin13888]

Follow-up to #407 (PR #459), which lands the OIDC relying party with in-memory adapters only.

What is owed

1. store::OidcAuthorizationStore — Valkey adapter. The pending authorization (state → nonce, PKCE verifier, redirect URI, issued_at) with the store's fixed ten-minute TTL and a destructive consume (a GETDEL, or GET + DEL in one MULTI). Register it on ValkeyStores and drop the Option from store::conformance::Harness::oidc_authorizations() together with the run_all skip — both exist only so a container-backed harness written before this adapter keeps compiling.
2. auth::oidc::FederatedAccounts — Postgres adapter, over the same account table as AccountDirectory/AccountRegistry/AccountProfiles. resolve_or_create is one statement: look up (issuer, subject); if absent and the asserted address already has a row, AddressTaken; otherwise insert an account row with a null credential and the federated link. The adapter contract: an account row whose credential is null makes AccountDirectory::authenticate and authenticate_user return Refused (after the timing-equalized miss), never Granted — "no password for OIDC accounts" made structural. Add that as a suite row beside the port.
3. The development profile. auth::oidc::InMemoryFederatedAccounts holds its own rows, separate from auth::accounts_memory::InMemoryAccounts, because the two live in different files and the lane that wrote it could not edit the latter. Consequences under serve --memory today: an OIDC identity whose address matches a password account is not refused with 409 error.auth.oidc_address_taken, and an OIDC account has no profile row (GET /v1/auth/profile answers 404 for it). Fold the federated rows into InMemoryAccounts (an Option<String> credential, a (issuer, subject) index) so the development profile has the same shape as Postgres.

Until then

boot::assemble refuses OIDC_ISSUER under the durable backends by name (BootError::AdapterUnavailable { key: "OIDC_ISSUER", .. }), so a durable profile never mixes an in-memory ceremony double (design/filesystem/server.md).

[justin13888]

Two notes from review round 1 on #459:

• Decision 11 (verified addresses only). Until the federated rows live in the one account table, an IdP-asserted address is reserved and compared only when email_verified is true; an unverified address never blocks another identity (a targeted DoS costing one unverified sign-up at the provider). When this issue folds the rows into InMemoryAccounts / the Postgres table, the comparison is against the address a password account registered with — keep the verified-only rule on the federated side.
• Decision 17 (bounding the pending store). The in-memory OidcAuthorizationStore purges expired records on every begin and refuses at a ceiling of 10 000 pending ceremonies (StoreError::Rejected → 503). The Valkey adapter gets expiry from the key TTL and needs no purge; whether it wants a ceiling at all is this issue's call.