oidcstub: percent-encode authorize redirect query params (PC1)

oidcstub: implement /authorize + /token auth-code+PKCE; inject window.__LETHE_CONFIG__ into SPA

auth: lift oidc test stub into internal/testutil/oidcstub