feat: replace JWT OAuth state with flow_state.id UUID

[fadymak]

• Migrate OAuth state parameter from JWT to UUID (flow_state.id)
• Add OAuth context fields to flow_state table (invite_token, referrer, oauth_client_state_id, linking_target_id, email_optional)
• Make PKCE fields nullable to support implicit flow
• Always create flow_state record for all OAuth flows, not just PKCE
• Add IsPKCE() method to distinguish PKCE vs implicit flows
• Backward compatible: callback still accepts legacy JWT state format
• Update all external provider tests to verify UUID state format

In a follow-up release, the legacy JWT state support will be removed; ensuring there are no breaking changes.

[coveralls]

Pull Request Test Coverage Report for Build 21030029041

Details

• 113 of 143 (79.02%) changed or added relevant lines in 6 files are covered.
• 13 unchanged lines in 3 files lost coverage.
• Overall coverage decreased (-0.02%) to 68.539%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/sso.go	10	11	90.91%
internal/api/pkce.go	9	11	81.82%
internal/models/flow_state.go	29	31	93.55%
internal/api/samlacs.go	0	5	0.0%
internal/api/external.go	56	76	73.68%

Files with Coverage Reduction	New Missed Lines	%
internal/api/sso.go	1	71.17%
internal/api/context.go	4	77.71%
internal/api/external.go	8	74.47%

Totals
Change from base Build 20948007489:	-0.02%
Covered Lines:	14725
Relevant Lines:	21484

---

💛 - Coveralls