Harden OAuth client and token validation

[haradahinata]

Summary

Fixes three related OAuth security issues:

• Fixes Security: OAuth redirect_uri not validated #6 by validating redirect_uri against the registered OAuth client redirect URIs on /authorize, /login, and /callback.
• Fixes Security: Access tokens never expire #7 by issuing OAuth access tokens with a 90-day expiresAt, returning expires_in, and rejecting/removing expired OAuth tokens during resolveUser.
• Fixes Security: Client secret comparison not timing-safe #8 by replacing direct client-secret comparison with a fixed-length SHA-256 digest comparison using crypto.timingSafeEqual.

Notes

The redirect URI helper accepts the current expected redirectUris array and also supports a legacy single redirectUri string if any existing client documents use that shape.

For existing OAuth tokens without expiresAt, validation falls back to createdAt + 90 days; tokens without either timestamp are rejected.

Validation

• npm ci in functions/
• npm run build in functions/
• git diff --check

I saw the earlier discussion about treating these as S-size security fixes under BOUNTIES.md. If you are open to formalizing the three related fixes together, I would be happy to coordinate the payout process you prefer after review.