feat: add discord oauth login

[LucHeart]

This PR introduces OAuth2 authentication and account linking into the API, starting with Discord as the first supported provider.

🔑 Key Additions

• OAuth Controller & Endpoints

  • GET /oauth/providers – list supported providers.
  • GET /oauth/{provider}/authorize – begin login-or-create flow.
  • GET /oauth/{provider}/handoff – process provider callback, either sign in or continue flow.
  • GET /oauth/{provider}/data – retrieve handoff data (email, display name, expiry).
  • POST /oauth/{provider}/finalize – finalize flow: create a new account or link to an existing one.

• Account OAuth Connections

  • GET /account/connections – list linked connections.
  • GET /account/connections/{provider}/link – initiate link flow.
  • DELETE /account/connections/{provider} – unlink a provider.

• Database & Services

  • Migration adds UserOAuthConnections table.
  • New OAuthConnectionService for managing external identities.
  • Extended AccountService with support for creating OAuth-only accounts (passwordless).
  • Added support for ASP.NET Core data protection key persistence.

• Authentication & Config

  • Short-lived cookie scheme for OAuth flow state.
  • Full Discord OAuth2 integration (configurable via options).
  • Expanded AuthConstants with flow types (login-or-create, link).

⚙️ Step-by-Step Flow

1. Frontend requests login/signup with Discord
   → Calls GET /oauth/discord/authorize

2. Redirect to Discord
   → User consents and Discord redirects back to /oauth/discord/handoff

3. Handoff decision

   • If the external account is already linked → user is signed in directly.
   • If not linked → frontend is redirected to oauth/discord/create (new account) or oauth/discord/link (link existing account).

4. Frontend fetches temporary identity data
   → Calls GET /oauth/discord/data to display email/display name.

5. Finalize flow

   • POST /oauth/discord/finalize
   • If action = create → new OAuth-only account is created and linked.
   • If action = link → external identity is attached to the logged-in account.

6. OAuth connection persisted
   → Stored in UserOAuthConnections and accessible under /account/connections.

🚀 Impact

• Users can now sign up or log in using Discord OAuth2.
• Existing users can link or remove Discord accounts from their profile.

[hhvrc]

@codex this PR is unfinished, still needs some extra logic around adding OAuth connections to accounts and creating accounts from OAuth, but how does it look till now?

[chatgpt-codex-connector]

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".