Add the three-legged OAuth 1.0a flow to social auth, HMAC-SHA1-signed
with Web Crypto (edge-native): social.twitter preset + social.driver1()
for any OAuth1 provider, OAuth1Driver (requestToken/redirect/accessToken/
user + signed get), and oauth1Signature() (RFC 5849, verified against the
canonical Twitter vector). SocialUser is now generic over its token type.
Additive; OAuth2 presets unchanged. +2 tests (405 total).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tn7UJG3uSLwPcWaKo9gHgC