feat: add unified auth handoff flow

[Zetazzz]

Summary

• converge reusable-session, local password, registration, and Provider success on one cryptographically random Site handoff
• redirect only to the transaction-restored exact HTTPS callback with handoff and Site state, with no-store and sensitive-query redaction
• add Site-server redemption through the existing routed API-key/service-principal boundary, returning a distinct Site-local credential and verified return target
• forward existing credential kind, token, principal, and API provenance claims through Express Context DB calls

Database contract

• completion wrappers receive only the SHA-256 bytea digest and atomically create the one-minute handoff
• redeem_sso_handoff(bytea) reads the existing routed API and authenticated service-principal claims, validates Tenant/Site/transaction bindings, issues the Site credential, and consumes on successful issuance
• no SSO-specific runtime secret or possession-only redemption path is introduced

Validation

• GraphQL server: 20 suites, 176 tests
• Express Context: 5 suites, 36 tests
• GraphQL server and Express Context builds
• package lint (existing warnings only)
• git diff --check

Stack

Depends on #1687. This PR intentionally targets feat/oauth-provider-http.