feat: complete OAuth account lifecycle

[artiphishle]

Goal

Complete every remaining Phase 3 responsibility owned by @ankhorage/supabase-auth in one repository PR. This is intentionally not split into smaller follow-up PRs.

Included scope

• canonical Google and Apple provider metadata normalization into AuthUser
• persistent-session expiry validation and cleanup
• local sign-out cleanup even when the remote logout request fails
• invalid refresh-token cleanup
• optional verification of the generated app-owned Supabase profile row
• typed profile_creation_failed outcomes when the identity exists but the profile invariant fails
• metadata-only OAuth lifecycle observation with one correlation ID per authorization attempt
• complete PKCE cleanup across cancellation, callback errors, exchange errors, persistence errors, profile errors, and success
• documented and tested account/identity collision policy based on current supported Supabase identity behavior
• complete unit/integration harness, docs, dependency/package checks, generated docs, and one changeset

Security boundary

Lifecycle events expose only correlation ID, provider, stage, status, and typed error code. They never expose authorization codes, callback URLs, access/refresh tokens, provider credentials, private keys, service-role keys, session payloads, or profile rows.

Profile verification uses the authenticated session only for the request boundary. Returned errors remain user-safe and contain no row or token contents.

Repository boundary

This PR owns the complete Supabase adapter/account lifecycle. Generated-app wiring belongs to the later single Studio repository completion PR; generated database/profile invariants belong to the later single Infra repository completion PR. No additional mini PR is planned for this repository.

Part of #18.