OAuth SSO infrastructure + account app support

- OAuthCode model + migration for authorization code flow
- OAuth client blueprint (auto-registered for non-federation apps)
- Per-app first-party session cookies (fixes Safari ITP)
- /oauth/authorize endpoint support in URL helpers
- account_url() helper + Jinja global
- Templates: federation_url('/auth/...') → account_url('/...')
- Widget registry: account page links use account_url

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/jinja_setup.py

@@ -13,7 +13,7 @@ from shared.browser.app.csrf import generate_csrf_token
 from shared.browser.app.authz import has_access
 from shared.browser.app.filters import register as register_filters
 
-from .urls import blog_url, market_url, cart_url, events_url, federation_url, login_url, page_cart_url, market_product_url
+from .urls import blog_url, market_url, cart_url, events_url, federation_url, account_url, login_url, page_cart_url, market_product_url
 
 
 def setup_jinja(app: Quart) -> None:
@@ -98,6 +98,7 @@ def setup_jinja(app: Quart) -> None:
     app.jinja_env.globals["cart_url"] = cart_url
     app.jinja_env.globals["events_url"] = events_url
     app.jinja_env.globals["federation_url"] = federation_url
+    app.jinja_env.globals["account_url"] = account_url
     app.jinja_env.globals["login_url"] = login_url
     app.jinja_env.globals["page_cart_url"] = page_cart_url
     app.jinja_env.globals["market_product_url"] = market_product_url