feat: converge OAuth SSO runtime integration - #1700

Summary

• replace the simulated SSO database contract with the generated Constructive DB runtime
• propagate trusted Site identity through routing, Express Context, pgSettings, and Graphile
• bind and validate Site-local sessions against unified-session revocation
• align opaque transaction, Provider OAuth, handoff, secret-loader, and cookie behavior with the real database contract
• cover local signup and GitHub Provider flows through PostgreSQL, GraphQL/OAuth HTTP, handoff redemption, replay rejection, and revocation
• align the real-runtime seed with the current capabilities_module baseline

Integration baseline

• Constructive DB runtime: ffc87bb07ede49a0734f676d0eb06042f0565eef (draft PR #3009)
• Constructive PR8: f51d88064788fc4aea5a3bfa51a1676b259399d7

Verification

• 101 targeted graphql-server tests
• 19 express-context tests
• graphql-server, express-context, and graphql-server-test builds
• real generated Constructive DB integration suite: 4 scenarios passed against PR #3009 commit ffc87bb07ede49a0734f676d0eb06042f0565eef
• ESLint and git diff checks

The integration suite runs the generated Constructive DB application through PostgreSQL and Constructive GraphQL/OAuth HTTP; the removed mock contract.sql remains absent.