feat(oauth): add owner app freeze, delete, and richer client settings

[matthew-demidoff]

Developer-experience pass on the OAuth app dashboard.

What

• New per-app settings for owners: app name, post-logout redirect URIs, allowed scopes, allowed grant types, refresh-token issuance. Validated against the canonical scope/grant lists, now exported from the oauth service instead of living as three inline copies.
• Freeze/unfreeze: new frozen app status, owner-set and owner-reversible (migration 026 widens the status check). Every enforcement path already requires status = active, so a frozen app is rejected at authorize/token/userinfo/introspect and the activation API, and its issued tokens stop validating until unfrozen.
• Permanent delete with type-the-slug confirmation. FK cascades remove tokens, secrets, codes, webhook endpoints, and authorizations; bearer_requests history survives with external_app_id nulled, so the stashed plaintext api key is cleared first.
• Pastel red danger styling: danger-soft/border/strong tokens, the Button danger variant is filled at rest, Section gains a danger tone, applied to the app danger zone and the settings Delete section.

Decisions worth review

• frozen vs disabled: owners flip active<->frozen only (guarded in SQL), so an admin-disabled app cannot be revived by its owner; the admin Enable action now refuses frozen apps instead of silently overriding the owner.
• Frozen apps still count toward the 10-app cap, since owners can thaw them at will.
• The Button danger restyle intentionally applies to every existing danger button (webhooks, admin, account deletion).

Tests: integration coverage for freeze transitions, ownership guards, cap counting, and delete cascades in tests/integration/external-app-owner-lifecycle.test.ts.