test: add unified auth integration coverage

[Zetazzz]

Summary

• add a real graphql-server-test seam over scoped routing, Express Context, GraphQL, cookies, and PostgreSQL
• verify canonical-host login start, local sign-in, hashed one-time handoff, cookie and no-store behavior, browser redemption rejection, and OAuth-disabled behavior
• fix the SSO surface loader to resolve the physical schema name rather than its logical metadata name

Stack

• Base: feat: add unified auth handoff flow #1688 (feat/oauth-sso-handoff)
• PR 7 of 7; review only this branch delta against its base

Test contract

• the local SQL fixture implements only the frozen Constructive/Constructive DB call boundary
• DB-owned transaction, RLS, and runtime semantics remain in the Constructive DB PR and are not duplicated here

Validation

• Express Context: 5 suites, 36 tests
• unified-auth integration: 4 tests
• scoped routing: 7 tests
• full graphql-server-test with local PostgreSQL and MinIO: 11 suites, 156 tests, 2 snapshots
• affected builds and lints pass; existing unrelated lint warnings remain
• git diff --check passes