fix(auth): honor Payload sessions for OAuth tokens

[WilsonLe]

Summary

• create Payload session records during OAuth callback when Payload sessions are active
• include the session sid in OAuth-issued Payload JWTs and validate it in the auth strategy
• reject sid-less or revoked session JWTs instead of recreating users from them
• move project instruction files under docs/instructions and add session troubleshooting guidance

Closes #52
Closes #62

Tests

• corepack pnpm build
• corepack pnpm test