refactor(oauth): deepen callback identity flow

[WilsonLe]

Closes #73

Summary

• Add resolved OAuth config, callback transaction, and identity modules to concentrate OAuth flow rules behind deeper interfaces.
• Make auth strategy authentication-only: valid JWT + missing user returns null with warning, invalid JWT errors surface.
• Keep callback signup behavior in callback flow, reuse existing OAuth users without profile update, and warn on invalid legacy config while preserving values.
• Replace shallow Google/Zitadel specs with provider matrix and callback/plugin contract coverage.
• Record durable architecture rules in docs/instructions/oauth-architecture.instructions.md.

Verification

• pnpm build
• pnpm test