feat: add OAuth provider HTTP flow

[Zetazzz]

Summary

• Add the OAuth authorization and callback HTTP flow.
• Persist only transaction and browser-binding digests in the DB contract.
• Carry the trusted device/session binding through Provider completion while keeping Provider tokens server-side.

Stack

Base: #1686
Next: #1688

Validation

• express-context tests: 35 passed at this layer
• Provider and GraphQL server tests: 18 passed
• affected package builds passed

[Zetazzz]

Superseded by same-repository stacked PR #1707. Review continues there; the implementation branch now lives in constructive-io/constructive.