feat(opensecret): support per-project OAuth callback allowlists

[AnthonyRonning]

Projects currently have one OAuth callback per provider. This adds a per-provider callback allowlist and an optional redirect_url on initiation, so separate browser origins can finish each flow on the origin that started it. Callers that omit the field continue to use the existing default.

• Record the selected callback in the complete one-use OAuth state and use it for Google/GitHub and Apple token exchange. Preserve the existing V1/V2, session, PKCE, nonce, expiry, and replay checks.
• Preserve stored additional callback lists when older settings clients omit the new field; explicit [] clears them. Serialize the read/merge/write per project, including first insertion.
• Validate at most 16 additional URLs with the existing generic URL rules. Update fresh-project constructors without adding any callback hosts, and remove unused environment-derived callback helpers.
• Add the API/compatibility contract and wire disposable database and encrypted transport tests into SDK integration CI, including change detection for the helper itself.

Stack and rollout

This is the first backend foundation PR, based on master. A later SDK PR can stack on this branch if this PR remains unmerged. SDK API changes, package publication, frontend adoption, provider registration, callback configuration, and traffic activation remain separate work. No SQL schema migration is needed, and this PR does not change deployed callback settings or default hosts.

Deploy compatible backend support before any consumer selects a non-default callback. On downgrade, older backends use the default and older settings writers can discard the new list; consumers depending on additional callbacks must first be taken out of that path. Pending OAuth states remain process-local and do not survive backend replacement.

Validation

Local checks used the pinned Nix environments on macOS:

• Formatting and strict cargo clippy --locked --all-targets --all-features -- -D warnings passed.
• cargo test --locked --all-features: 714 passed, 26 ignored in the regular run.
• Disposable PostgreSQL harness: 25 passed, none skipped (20 existing AEAD/database, 2 existing OAuth, 2 new settings tests, and 1 new encrypted callback matrix). The concurrency test observes a real blocked database writer; the transport matrix covers all three providers over V1 and V2. The temporary cluster was removed.
• Root nix flake check --no-update-lock-file passed for the current host; workflow and change-detection tests passed.
• Independent source and CI reviews completed; the identified helper change-detection gap was fixed.

OAuth provider exchanges, released applications, Nitro artifacts, and deployed environments were not exercised. The one credentialed live-provider test remains unrun. GitHub CI will provide the Linux build and in-tree SDK integration results.