feat: add tenant SSO context surface

[Zetazzz]

Stack

• base: feat/oauth-provider-adapters (feat: add OAuth provider adapters #1684)
• this PR contains only the Express Context SSO-surface increment

Summary

• add a typed opt-in ssoSurface module to the complete req.constructive context
• resolve the current database's provisioned unified_auth_module private schema through authoritative module metadata
• return undefined when the current Tenant has no provisioned unified-auth module
• keep the loader out of createDefaultRegistry() so the auth service explicitly owns its registration and cost

Isolation boundary

The loader requires the request Context database ID, binds its metadata query to that ID, and requires database scope. It does not infer Tenant/database from request input, scan another database, fall back to a global sso_private, or read Site policy and Provider secrets.

This query matches the Constructive DB unified-auth foundation at 7692146ee12; the dependency pin remains a later integration-slice responsibility.

Validation

• pnpm --filter @constructive-io/express-context build
• pnpm --filter @constructive-io/express-context exec jest --runInBand (4 suites, 32 tests)
• focused ESLint on the changed source and test files
• git diff --check