oidcstub: implement /authorize + /token auth-code+PKCE; inject window.__LETHE_CONFIG__ into SPA
auth: lift oidc test stub into internal/testutil/oidcstub