Add a Provider-scoped OAuth driver framework #93

Part of #71.

Outcome

Add a Provider-scoped OAuth driver contract on top of the approved credential-reference and secret-store boundary.

Scope

• Support authorization-code with PKCE/state/nonce, loopback callbacks, and RFC 8628 device flow where a Provider allows them.
• Define scopes, callback policy, token expiry, single-flight refresh, refresh-token rotation, logout/revoke/re-auth, and backend-only request injection.
• Keep Provider client registration and entitlement policy explicit and independently reviewable.
• Expose only masked auth state and actionable errors to the frontend.

Non-goals

• A generic “works with every Provider” claim or reuse of another product's allowlisted OAuth client identity.

Acceptance criteria

• Driver interface keeps Provider-specific endpoints, scopes, and policies isolated.
• PKCE, state, nonce, callback validation, refresh rotation, and revocation fail closed.
• Concurrent refresh is single-flight and atomic.
• Tokens never reach frontend state, logs, telemetry, diagnostics, or exports.
• No Provider is enabled without documented registration and entitlement evidence.

Required verification

• Deterministic authorization, callback, refresh, rotation, logout, and error-path tests.
• Threat-model review for callback, token, and credential boundaries.
• Backend/frontend contract and redaction tests.