feat: add OAuth provider HTTP flow

[Zetazzz]

Summary

• Add the OAuth authorization and callback HTTP flow.
• Persist only transaction and browser-binding digests in the DB contract.
• Carry the trusted device/session binding through Provider completion while keeping Provider tokens server-side.

Stack

Base: #1706
Next: #1708

Validation

• express-context tests: 35 passed at this layer
• Provider and GraphQL server tests: 18 passed
• affected package builds passed