OAuth SSO infrastructure + account app support

- OAuthCode model + migration for authorization code flow
- OAuth client blueprint (auto-registered for non-federation apps)
- Per-app first-party session cookies (fixes Safari ITP)
- /oauth/authorize endpoint support in URL helpers
- account_url() helper + Jinja global
- Templates: federation_url('/auth/...') → account_url('/...')
- Widget registry: account page links use account_url

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

browser/templates/_types/auth/_nav.html

@@ -1,5 +1,5 @@
 {% import 'macros/links.html' as links %}
-{% call links.link(federation_url('/auth/newsletters/'), hx_select_search, select_colours, True, aclass=styles.nav_button) %}
+{% call links.link(account_url('/newsletters/'), hx_select_search, select_colours, True, aclass=styles.nav_button) %}
   newsletters
 {% endcall %}
 {% for link in account_nav_links %}

browser/templates/_types/auth/_newsletter_toggle.html

@@ -1,6 +1,6 @@
 <div id="nl-{{ un.newsletter_id }}" class="flex items-center">
   <button
-    hx-post="{{ federation_url('/auth/newsletter/' ~ un.newsletter_id ~ '/toggle/') }}"
+    hx-post="{{ account_url('/newsletter/' ~ un.newsletter_id ~ '/toggle/') }}"
     hx-headers='{"X-CSRFToken": "{{ csrf_token() }}"}'
     hx-target="#nl-{{ un.newsletter_id }}"
     hx-swap="outerHTML"

browser/templates/_types/auth/_newsletters_panel.html

@@ -22,7 +22,7 @@
                 {# No subscription row yet — show an off toggle that will create one #}
                 <div id="nl-{{ item.newsletter.id }}" class="flex items-center">
                   <button
-                    hx-post="{{ federation_url('/auth/newsletter/' ~ item.newsletter.id ~ '/toggle/') }}"
+                    hx-post="{{ account_url('/newsletter/' ~ item.newsletter.id ~ '/toggle/') }}"
                     hx-headers='{"X-CSRFToken": "{{ csrf_token() }}"}'
                     hx-target="#nl-{{ item.newsletter.id }}"
                     hx-swap="outerHTML"

browser/templates/_types/auth/header/_header.html

@@ -1,7 +1,7 @@
 {% import 'macros/links.html' as links %}
 {% macro header_row(oob=False) %}
   {% call links.menu_row(id='auth-row', oob=oob) %}
-    {% call links.link(federation_url('/auth/account/'), hx_select_search  ) %}
+    {% call links.link(account_url('/'), hx_select_search  ) %}
       <i class="fa-solid fa-user"></i>
       <div>account</div>
     {% endcall %}

browser/templates/_types/root/_full_user.html

@@ -1,5 +1,5 @@
  
-{% set href=federation_url('/auth/account/') %}
+{% set href=account_url('/') %}
 <a
     href="{{ href }}"
     class="justify-center cursor-pointer flex flex-row items-center p-3 gap-2 rounded bg-stone-200 text-black {{select_colours}}"

browser/templates/_types/root/mobile/_full_user.html

@@ -1,5 +1,5 @@
  
-{% set href=federation_url('/auth/account/') %}
+{% set href=account_url('/') %}
 <a
     href="{{ href }}"
     data-close-details