feat: add canonical OAuth fixtures

[artiphishle]

Summary

• remove template-owned OAuth provider-entry screen generation so Studio remains the single auth UI/runtime owner
• add exported Google, Apple, and combined OAuth manifest fixtures
• use the canonical relative callback route auth/callback
• keep provider credentials as logical server-side credentialsRef values only
• preserve the canonical infra.auth.flow from the shared template defaults
• consume @ankhorage/contracts 3.x

Fixture API

• OAUTH_CALLBACK_ROUTE
• OAUTH_FIXTURE_IDS
• listOAuthFixtures()
• resolveOAuthFixture()
• createOAuthFixtureManifest()

Fixture definitions are cloned on read and contain only provider IDs, labels, scopes, query parameters, icons, and logical credential references.

Ownership

Templates now produce manifest configuration only. They no longer create an OAuthProviderList screen or any other OAuth auth UI. The released Studio generator remains the single owner of provider controls, browser/deep-link transport, callback completion, session persistence, and refresh behavior.

Redirect documentation

docs/oauth-fixtures.md distinguishes the two redirect layers:

• Google and Apple provider consoles use the Supabase Auth callback, normally https://<project-ref>.supabase.co/auth/v1/callback
• Supabase Redirect URLs contain the application-facing web and generated native callback URIs ending in /auth/callback

The guide links to the official Supabase Google, Apple, Redirect URL, and native deep-linking documentation and explicitly does not claim live provider E2E.

Safety

• no client secrets, private keys, service-role keys, Vault IDs, authorization codes, or tokens
• no unsupported first-party providers
• no OAuthProviderList nodes generated by Templates
• sentinel regression coverage across definitions and generated manifests
• no temporary workflows or diagnostic files in the final diff

Tests

• no duplicate template-owned auth screen
• deterministic Google, Apple, and combined definitions
• canonical callback and credential refs
• all-category auth-flow preservation
• isolated fixture definitions
• existing secret-store coverage updated to the canonical callback

Validation

• frozen dependency install
• build
• lint
• format check
• Knip
• tests
• source and test typecheck
• changeset status
• generated README and Paradox documentation

Release

Includes a minor changeset for @ankhorage/templates.

Closes #129
Part of ankhorage/supabase-auth#18