feat(auth): add Repo App user authorization

[sabbour]

Summary

• add Entra-human-bound Repo App authorization begin, browser callback, safe polling, refresh, and revocation endpoints
• persist only opaque references; enforce PKCE S256, fixed-time callback-cookie validation, atomic transaction claims, stable grant versions, and fail-closed transaction/credential fencing
• document Repo App configuration and add focused transaction, secrecy, refresh, revocation, and concurrency coverage

Validation

• npm run validate:layer -- --area dotnet --dotnet-filter "FullyQualifiedName~RepoAppUserAuthorizationServiceTests|FullyQualifiedName~TwoAppPersistenceStoreTests" (27 passed)
• npm run version:check
• npm run changeset:check

Reviews

• Post-implementation code review complete; findings addressed.
• Seraph-style security review complete; no high-confidence findings.

Note

• Local docs build could not run because the configured package proxy returned 404 for mermaid@11.17.1; the documentation change is limited to configuration/API references.

Closes #941

[sabbour]

Post-implementation review complete. The code-review pass identified transaction fencing, refresh concurrency, revocation, and post-claim finalization risks; all were addressed and focused validation was rerun. Seraph-style security review reported no high-confidence security findings on the final change.

npm run validate:layer -- --area dotnet --dotnet-filter "FullyQualifiedName~RepoAppUserAuthorizationServiceTests|FullyQualifiedName~TwoAppPersistenceStoreTests" passes (27 tests).