feat(runtime-host): bind OAuth login to Connection entities

[me2seeks]

Summary

• bind every interactive OAuth login to one explicit Connection target: create(providerType) or existing(connectionId)
• allocate and recover OAuth Connection identity, credential publication, and authenticated receipts in Runtime Host/Storage
• migrate Desktop add/re-login/status/refresh/logout paths to exact Connection identity and fail closed on mismatch or ambiguity
• replace silent attempt supersede with operation_conflict and advance the Runtime Host compatibility epoch from 53 to 54

Stack

This is the OAuth entity-binding workstream of #3852 and is stacked after #3882. Review the final commit c88dd63b1 for this PR's isolated change.

Closes #3888.

Validation

• npm --workspace @maka/core run typecheck
• npm --workspace @maka/storage run typecheck
• npm --workspace @maka/runtime-host run typecheck
• npx tsc -p apps/desktop/tsconfig.main.json --noEmit
• Storage full suite: 995 tests, 977 passed, 18 skipped
• Runtime Host OAuth/protocol focused suite: 73 passed
• Desktop OAuth/Connections focused suite: 17 passed
• node scripts/protocol-epoch-check.mjs --base f1fa3f9c7 --head HEAD (53 -> 54)
• git diff --check f1fa3f9c7..HEAD

[me2seeks]

Addressed the current hosted format:check failure on head 04dd9c1b7 by applying Biome formatting to the two reported Storage files. The follow-up commit changes only line wrapping; two independent reviews confirmed no identity, authority, argument, or control-flow change.

The OAuth entity-binding commit is patch-equivalent across the final restack onto #3882. Validation: Storage 995 tests passed with 18 platform skips, Storage typecheck, Biome check, protocol epoch guard (54), and diff-check.

Generated-by: Codex

[Astro-Han]

I reviewed this head and found no blocking issues.

Binds each interactive OAuth login to an explicit target (create(providerType) or existing(connectionId)) with persistent oauth-login-receipts (monotonic order, attemptId dedup, target↔identity checks), turning silent supersede into operation_conflict; correct identity matching, fail-closed conflict, legacy adoption CAS retry, and onboarding ticket fixing TOCTOU; hosted test+windows_recovery SUCCESS.

No P0-P3.

简体中文

该头无阻断。

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.