refactor: separate oauth wire responses

[zatevakhin]

summary

• add semantic oauth flow and result types to the auth domain
• keep oauth response dtos protocol-owned and adapt them before app events
• store real oauth ingress in provider-scoped domain result state
• keep clipboard and other app/ui feedback in a separate AuthUiNotice

behavior

• malformed oauth dto decode remains silently ignored
• provider refresh remains unchanged for both success and failure results
• success clears the flow and returns to the provider list; failure keeps the active flow and panel
• oauth result display is intentionally provider-scoped so stale messages from one provider do not appear while another provider is selected
• ui notices take display precedence when applicable and may be provider-scoped or generic; clipboard success is explicitly scoped to its provider and is not represented as an oauth outcome
• entering provider detail, restarting oauth, reopening auth, dismissing detail, initialization, flow-start, and oauth results all clear stale notices so transient ui feedback never lingers across flows
• redirect callback trimming, device polling, disconnect, clipboard fallback, and oauth success provider mismatch behavior remain unchanged

validation

• cargo fmt --all -- --check
• cargo check --all-targets
• cargo clippy --all-targets --all-features -- -D warnings
• cargo build --all-targets
• cargo test --all-targets (752 passed)
• architecture acceptance searches for legacy oauth names, dto boundary violations, and ui notices under domain