feat: converge OAuth SSO runtime integration

[Zetazzz]

Summary

• replace the simulated SSO database contract with the generated Constructive DB runtime
• propagate trusted Site identity through routing, Express Context, pgSettings, and Graphile
• bind and validate Site-local sessions against unified-session revocation
• align opaque transaction, Provider OAuth, handoff, secret-loader, and cookie behavior with the real database contract
• cover local signup and GitHub Provider flows through PostgreSQL, GraphQL/OAuth HTTP, handoff redemption, replay rejection, and revocation
• align the real-runtime seed with the current capabilities_module baseline

Integration baseline

• Constructive DB runtime: ffc87bb07ede49a0734f676d0eb06042f0565eef (draft PR #3009)
• Constructive PR8: f51d88064788fc4aea5a3bfa51a1676b259399d7

Verification

• 101 targeted graphql-server tests
• 19 express-context tests
• graphql-server, express-context, and graphql-server-test builds
• real generated Constructive DB integration suite: 4 scenarios passed against PR #3009 commit ffc87bb07ede49a0734f676d0eb06042f0565eef
• ESLint and git diff checks

The integration suite runs the generated Constructive DB application through PostgreSQL and Constructive GraphQL/OAuth HTTP; the removed mock contract.sql remains absent.

[Zetazzz]

Superseded by the rewritten seven-PR stack. Its functional changes were reassigned to the owning layers in PRs #1683-#1689: generic error mapping in PR1, trusted Site/context loaders in PR3, opaque transaction handling in PR4, Provider runtime convergence in PR5, handoff and session binding/revocation in PR6, and real generated Constructive DB integration in PR7. PR7 now passes the real DB integration suite pinned to Constructive DB commit ffc87bb07ede49a0734f676d0eb06042f0565eef; the temporary contract.sql remains removed.