Share OAuth authorization-code client flow

[bherila]

What changed

• adds a reusable OAuth authorization-code client with PKCE
• validates callback state, token exchange, and provider identity responses
• returns a small normalized identity value object
• leaves local-user provisioning and authorization policy in each consuming app
• documents the shared/app ownership boundary

Why

SVC, Games, and PHR currently duplicate the same protocol mechanics. Centralizing them here keeps security fixes and provider behavior consistent without coupling app-specific user rules.

Validation

• composer validate --strict
• composer test (43 tests, 105 assertions)