feat: add OAuth server config and errors

[Zetazzz]

Summary

• Add stable OAuth/SSO domain errors and registrations.
• Add GraphQL-owned OAuth server options using the existing 12-factor environment abstractions.
• Map registered Constructive errors through the generic GraphQL server error handler.
• Add the OAuth/SSO requirements, formal Spec, working Draft, and Constructive DB, Constructive, and Dashboard detailed designs under docs/sso.

Stack

Base: main
Next: #1704

Validation

• errors tests: 54 passed
• graphql-env tests: 23 passed
• GraphQL server build passed
• Documentation relative links, Markdown fences, and git diff --check passed