feat: add OAuth/social login providers plugin (Phase 1)

[lane711]

Summary

Adds OAuth2/OIDC social login support as a core plugin, implementing Phase 1 of #737. Users can sign in via GitHub or Google using the standard OAuth2 authorization code flow, with automatic account linking by email.

Changes

• New plugin: oauth-providers built with the PluginBuilder SDK
• OAuth2 authorization code flow with cryptographic CSRF state protection
• Two built-in providers: GitHub and Google (provider-agnostic design makes adding more trivial)
• Account linking: OAuth profiles are auto-linked to existing accounts by email match
• New user creation: Creates accounts from OAuth profile data when no matching email exists
• Database migration (034): oauth_accounts table with proper indexes and foreign key to users
• Routes:
  • GET /auth/oauth/:provider — Redirect to provider authorization
  • GET /auth/oauth/:provider/callback — Handle OAuth callback
  • POST /auth/oauth/link — Link OAuth to existing account
  • POST /auth/oauth/unlink — Unlink OAuth provider
  • GET /auth/oauth/accounts — List linked accounts
• Zero new dependencies — uses native fetch for all OAuth HTTP calls
• Cloudflare Workers compatible — no Node.js-specific APIs
• Plugin registered in core plugins index, bootstrap service, and app route mounting

Files Changed

• packages/core/src/plugins/core-plugins/oauth-providers/index.ts (new)
• packages/core/src/plugins/core-plugins/oauth-providers/oauth-service.ts (new)
• packages/core/src/plugins/core-plugins/oauth-providers/manifest.json (new)
• packages/core/src/db/migrations/0010_oauth_accounts.sql (new)
• packages/core/src/db/migrations-bundle.ts (migration 034 added)
• packages/core/src/app.ts (route registration)
• packages/core/src/index.ts (exports)
• packages/core/src/plugins/core-plugins/index.ts (exports + CORE_PLUGIN_IDS)
• packages/core/src/services/plugin-bootstrap.ts (core plugin entry)

Testing

• All 55 existing test files pass (1399 tests pass, 0 failures)
• Lint passes (warnings only, consistent with existing codebase)
• TypeScript type-check passes with zero errors

Configuration

After enabling the plugin, configure provider credentials in the admin plugin settings page:

{
  "providers": {
    "github": { "clientId": "...", "clientSecret": "...", "enabled": true },
    "google": { "clientId": "...", "clientSecret": "...", "enabled": true }
  }
}

Future Work (Phase 2+)

• Discord, Microsoft/Azure AD, Generic OIDC providers
• TOTP/2FA integration
• Account linking management UI
• JWT claims enrichment from OAuth profiles

Fixes #737