oidcstub: implement /authorize + /token auth-code+PKCE; inject window.__LETHE_CONFIG__ into SPA

docs(lethe-web-ui-palette-savedsearch): record review pass + conclusion

savedsearch: reject ?owner= on DELETE; cover all write paths in test (IV2)

web: palette — gate prefetch with enabled+staleTime per plan 4.2

docs(lethe-web-ui-palette-savedsearch): record verify-driven fix-up + checks

test(lethe): register savedsearch repo+handler in e2e steward graph

docs(lethe-web-ui-palette-savedsearch): plan + execute deviations

web: palette items — projects, sessions, saved searches

Extend the command palette with three new item kinds (project, session,
saved) backed by unconditional TanStack Query hooks. Items are grouped in
fixed order (jump → projects → sessions → saved) with section headers;
fire() dispatches kind-aware navigation; .palette-group-head CSS added.

web: sectioned /settings with saved-searches CRUD

Add four TanStack Query hooks (useSavedSearches, useCreateSavedSearch,
useUpdateSavedSearch, useDeleteSavedSearch) backed by IF3 contract.
Introduce apiFetchVoid in client.ts for the 204 No Content DELETE path.
Replace the placeholder /settings route with a two-column sectioned shell
(SectionRail + SavedSearchesSection); Display section is disabled pending #8.

web: adapter — add Session.sessionId, SavedSearch DTO; fix composite-id call sites

savedsearch: add /api/v1/saved-searches CRUD with 0002 migration

web: add lambda favicon (svg + ico + apple-touch-icon)

Introduces the project mark — a Greek capital lambda Λ (initial of
Λήθη / Lethe) standing above a stylized rust ripple on a deep ink
plate. Reads as a glyph at 16 px; the ripple and inner rim emerge
at 32 px and above.

Three formats are shipped via web/public/ so Vite copies them
verbatim into the embedded dist bundle:

  - favicon.svg          canonical 64x64 vector source
  - favicon.ico          16/32/48 multi-resolution legacy fallback
  - apple-touch-icon.png 180x180 iOS home-screen bookmark

The ICO and PNG were rasterized from the SVG with rsvg-convert
(ImageMagick's built-in MSVG renderer drops strokes); magick is
only used to assemble the multi-image ICO container.

The dist/ placeholder index.html is regenerated alongside so a
fresh clone that hasn't run web-build yet still serves the icon
links from the committed fallback HTML.

docs(lethe-oidc-stub): record review pass + conclusion

docs(lethe-oidc-stub): record verify pass

docs(lethe-oidc-stub): record verify-driven fix-up deviations

auth: fix OIDCVerifier injection wiring + OIDCDevStub root attachment

Surfaced by the first end-to-end smoke of `auth.oidc.enabled=true`:

- `OIDCVerifier.Cfg` was typed `config.OIDCConfig`, but only `AuthConfig`
  is registered as a `config-section:""` (config.go:31-37). Steward's
  type-keyed injection threw `failed to find dependency` at `mgr.Inject`,
  panicking the daemon. Latent since 80b1c09 — never reached because no
  prior verified path enabled OIDC. Retyped to `config.AuthConfig`,
  Init now reads `Cfg.OIDC.{Issuer,Audience,UsernameClaim}`. Sibling-
  consistent with `Authenticator` and `OIDCDevStub`.

- `OIDCDevStub` had no dependents and no `steward.Root()` modifier, so
  steward logged `ERR empty dependents asset without root option` and
  skipped it in lifecycle bookkeeping (Destroy never called on shutdown).
  Added `steward.Root()` to its registration; shutdown log now shows
  `destroying component component=auth.OIDCDevStub`.

docs(lethe-oidc-stub): record execute deviations

auth: integrate oidcstub as opt-in dev OP under auth.oidc.dev_stub

config: add auth.oidc.dev_stub block (disabled by default)

auth: lift oidc test stub into internal/testutil/oidcstub