feat: replace JWT OAuth state with flow_state.id UUID

[fadymak]

• Migrate OAuth state parameter from JWT to UUID (flow_state.id)
• Add OAuth context fields to flow_state table (invite_token, referrer, oauth_client_state_id, linking_target_id, email_optional)
• Make PKCE fields nullable to support implicit flow
• Always create flow_state record for all OAuth flows, not just PKCE
• Add IsPKCE() method to distinguish PKCE vs implicit flows
• Backward compatible: callback still accepts legacy JWT state format
• Update all external provider tests to verify UUID state format

In a follow-up release, the legacy JWT state support will be removed; ensuring there are no breaking changes.

Closes AUTH-981
Closes AUTH-969

[coveralls]

Pull Request Test Coverage Report for Build 21059992921

Details

• 116 of 152 (76.32%) changed or added relevant lines in 6 files are covered.
• 16 unchanged lines in 5 files lost coverage.
• Overall coverage decreased (-0.05%) to 68.512%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/pkce.go	10	12	83.33%
internal/api/sso.go	11	14	78.57%
internal/models/flow_state.go	30	34	88.24%
internal/api/samlacs.go	0	5	0.0%
internal/api/external.go	56	78	71.79%

Files with Coverage Reduction	New Missed Lines	%
internal/api/pkce.go	1	79.71%
internal/api/sso.go	1	70.18%
internal/tokens/service.go	2	80.91%
internal/api/context.go	4	77.71%
internal/api/external.go	8	74.29%

Totals
Change from base Build 20948007489:	-0.05%
Covered Lines:	14724
Relevant Lines:	21491

---

💛 - Coveralls

[hf]

I wonder if it makes sense to proactively delete from the flow_state table when an OAuth flow is being started. Want to avoid the problems with a giant table that does not get cleaned up under a DOS-like scenario.