oidcstub: percent-encode authorize redirect query params (PC1)
oidcstub: implement /authorize + /token auth-code+PKCE; inject window.__LETHE_CONFIG__ into SPA
auth: lift oidc test stub into internal/testutil/oidcstub