feat: add OAuth provider HTTP flow

[Zetazzz]

Summary

• add the stable Provider-start GraphQL mutation and persist Tenant-local OAuth state, S256 PKCE verifier, nonce, callback URI, browser binding, and unified-transaction association before navigation
• mount only the OAuth-enabled authorize and callback browser routes; consume state before handling Provider code/error and keep Provider tokens server-side
• resolve enabled Tenant Provider configuration through the existing Express Context loader and protocol-neutral adapter boundary
• apply normalized identities through a fixed DB wrapper contract that owns connected-account matching/provisioning and fail-closed strict-auth exclusion
• set only a Secure, HttpOnly, host-only auth-center cookie and render safe restart failures
• redact OAuth state/code/error plus handoff/token query values from request logs

Stack

Base: feat/oauth-sso-graphql / #1686. This is PR 5 of the OAuth/SSO platform-integration stack.

The runtime operations depend on matching Tenant-private Constructive DB functions for Provider request start/read/consume and normalized identity completion. Shared Site handoff creation/redemption is intentionally PR 6; until then a successful callback uses the safe terminal success page when no continuation is returned.

Validation

• @constructive-io/graphql-server: 19 suites / 167 tests
• @constructive-io/express-context: 5 suites / 34 tests
• OAuth/SSO errors contract: 17 tests
• builds: express-context, errors, graphql-server, graphql-server-test
• lint for affected packages (existing warnings only)
• offline frozen-lockfile validation
• git diff --check