feat(auth): add OAuth2AuthCodeAuth and OAuth1Auth specs

[discreteds]

Summary

• Aligns DescriptorProfile.post_init signature with base class
• Adds OAuth2AuthCodeAuth spec — OAuth 2.0 Authorization Code grant with expiry tracking (promotes local def from mountainash-wearables)
• Adds OAuth1Auth spec — OAuth 1.0a credentials and tokens for Garmin Health API and legacy integrations
• Both exported from mountainash_settings.auth and top-level package

Test plan

• All existing tests pass (no regressions)
• New parametrized discriminator tests for both specs
• Required field validation (ValidationError without them)
• SecretStr wrapping verified
• Optional fields default to None
• Frozen immutability inherited from base
• Ruff lint passes
• No new mypy errors

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud