feat: OIDC phase 2 — session-bound refresh tokens, server-side logout

Hub sessions gain an optional sid backed by auth_sessions (login/reissue
write the row; POST /auth/logout revokes it; pre-phase2 tokens are
refused at reissue so revocation applies from the next epoch bump).
The OIDC provider issues rotating refresh tokens (oidc_refresh_tokens,
SHA-256 at rest, family-wide revocation on reuse detection) that live
and die with the consenting Hub session — an oCIS session can no longer
outlive the sign-in that minted it, and Hub logout propagates at the
next refresh instead of the next silent-authorize. Discovery advertises
refresh_token. Migration 034; RLS via the audit_append definer pattern
for the unauthenticated token-endpoint lookup.

apps/api/src/oidc/oidc.controller.ts

@@ -48,7 +48,7 @@ export class OidcController {
   @Header("Cache-Control", "no-store")
   consent(@Req() request: Request & AuthenticatedRequest, @Body() body: unknown): Promise<{ redirectTo: string }> {
     const session = requireSession(request);
-    return this.oidc.consent(session.workspaceId, session.userId, body);
+    return this.oidc.consent(session.workspaceId, session.userId, body, session.sid ?? null);
   }
 
   @Post("token")