sdk: add optional OAuth callback selection

[AnthonyRonning]

Builds on #978. Browser OAuth initiation can select an exact backend-registered callback while existing callers continue using their provider default. Google, GitHub, and Apple gain an optional final argument in both the low-level API and React context; platform settings expose the optional additional-callback list. Backend support and provider registration must precede selecting a new callback.

This is the callback-only SDK foundation for the auth-domain migration. It preserves existing credential persistence, login, refresh, logout, account confirmation, and native handoff behavior. Credential cleanup and cross-tab storage coordination are deferred to separate work after the migration is stable in production. This PR includes no cleanup API or storage changes.

Prepares TypeScript SDK version 4.1.0. Application dependency pins, runtime dependencies, and the Rust SDK are unchanged. Adds offline initiation coverage for all three providers, encrypted integration coverage for the callback/settings contract, and packed-package checks for the old and new React method signatures.

Validation:

• Pinned SDK package validation: frozen install, audit, formatting, TypeScript/Vite build, 277 passed / 3 hosted-attestation skips, and actual tarball consumers for ESM, CommonJS, browser UMD, Bundler, and NodeNext.
• Isolated local PostgreSQL + in-tree backend with non-loopback outbound access blocked: 83 passed / 18 existing skips across seven SDK integration files. The encrypted OAuth test covers Google/GitHub default/additional callbacks, rejection, and omitted/null/empty settings updates. Apple initiation has offline unit coverage; no real OAuth provider exchange is performed.
• Repository nix flake check --no-update-lock-file passed on aarch64-darwin. Normal pre-commit checks run without bypass.
• Independent source review confirmed no credential/session lifecycle changes in the final diff.

No package publication, deployment, provider configuration, or application dependency update is included. Real hosted-auth repeat-login/account-switch/expired-session rehearsal remains part of auth integration.

[github-actions]

Maple development preview: https://1a490869.maple-ca8.pages.dev

Commit: 89c91b594618de470ae2383f32264a79f63594ca

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.