feat: add OAuth server config and errors

[Zetazzz]

Summary

• add GraphQL-server-owned OAuth enablement and bounded Provider request timeout options
• parse explicit OAuth environment overrides through 12factor-env and validate the final merged options
• register the stable OAuth/SSO public error contract and preserve internal error causes without exposing them

Why

This establishes the configuration and error foundations for the staged OAuth/SSO platform integration. OAuth remains disabled by default, malformed explicit configuration fails during option resolution, and Tenant Provider endpoints and credentials stay outside process-level environment configuration.

This PR intentionally contains no Provider adapters, Express Context changes, routes, database calls, or session/handoff implementation.

Validation

• pnpm --filter @constructive-io/errors exec jest --runInBand
• pnpm --filter @constructive-io/graphql-env exec jest --runInBand
• pnpm --filter @constructive-io/errors build
• pnpm --filter @constructive-io/graphql-types build
• pnpm --filter @constructive-io/graphql-env build
• focused ESLint on changed TypeScript files
• git diff --check