feat: define canonical OAuth adapter contract

[artiphishle]

Part of ankhorage/supabase-auth#18.

Summary

• replace the optional URL-only OAuth adapter methods with one canonical adapter.oauth capability;
• require both authorization start and callback completion whenever OAuth is advertised;
• model enabled providers, exact redirect URI, opaque authorization attempts, platform callback/cancellation/error transport results, typed OAuth failures, and successful completion through the existing AuthSession contract;
• make infra.auth.oauth.callbackRoute the only manifest callback source by removing provider-level redirectTo;
• remove signInWithOAuth, completeOAuthSignIn, supportsOAuth, oauthProviders, and the superseded URL-only DTOs;
• add regression coverage and a major changeset for @ankhorage/contracts.

Scope

This PR defines provider-neutral contracts only. Supabase PKCE implementation, platform browser/deep-link transport, generated callback routes, and secure session persistence remain in the subsequent Phase 3 package PRs.

Validation

• build
• lint
• format check
• Knip
• tests
• typecheck
• changeset status

All repository CI checks pass on the current head.