CoinPay OAuth can create a session without a user subject

[phucnguyen1707]

The CoinPay OAuth callback should require a stable user identity from the userinfo response before creating a signed session.

Repro path:

1. Start the callback with a valid state and authorization code.
2. Have the token endpoint return a valid access token.
3. Have /api/oauth/userinfo return 200 with profile fields like email/name, but no sub value.
4. The callback can still create logicsrc_coinpay_session with sub set to null.

Expected: the callback should fail the OAuth flow and avoid setting a session cookie when userinfo does not provide a subject.

Actual: the callback can continue and sign an authenticated session without a stable user subject.

PR with a focused fix and contract test: #21