Harden OAuth 2.0 PKCE authentication

[niklashof]

Summary

• replace the legacy password grant with OAuth authorization code + PKCE, based on Implement OAuth 2.0 + PKCE authentication flow dgreif/ring#1750
• preserve the public refresh-token, 2FA, and token-rotation contracts
• scope cookies correctly, restrict redirects to Ring origins, validate state and PKCE, and avoid logging auth material
• keep the unrelated v3 device/location endpoint migration out of this change

Validation

• npm run test
• npm run build
• npm run lint
• 15 focused auth tests covering 2FA, non-2FA, refresh, plaintext 406, state mismatch, untrusted redirects, both CSRF bootstrap formats, and secret-log regression

Provenance

Auth flow adapted from dgreif#1750 with the open review findings addressed.