Add OAuth authorize endpoint, move account routes to account app

- /oauth/authorize: validates client_id, redirect_uri, issues auth codes
- Remove account/newsletters/widget routes (now in account microservice)
- Default post-login redirect: federation home instead of /auth/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

bp/auth/services/login_redirect.py

@@ -32,7 +32,7 @@ def store_login_redirect_target() -> None:
 def pop_login_redirect_target() -> str:
     path = session.pop(LOGIN_REDIRECT_SESSION_KEY, None)
     if not path or not isinstance(path, str):
-        return federation_url("/auth/")
+        return federation_url("/")
 
     # Absolute URL: return as-is (cross-app redirect)
     if path.startswith("http://") or path.startswith("https://"):
@@ -42,4 +42,4 @@ def pop_login_redirect_target() -> str:
     if path.startswith("/") and not path.startswith("//"):
         return federation_url(path)
 
-    return federation_url("/auth/")
+    return federation_url("/")