#40737 chore: migrate OAuth services admin DDP methods to REST

Summary

Continues the DDP→REST sweep (#40659, #40711, #40675, #40724, #40728, #40734, #40736). This batch migrates the three OAuth services admin DDP methods that backed the Admin → OAuth settings group. DDP methods stay registered for external SDK/mobile clients with deprecation logs pointing at the new routes.

Endpoints

DDP method	REST endpoint	Notes
addOAuthService	POST /v1/settings.addCustomOAuth	already exists, DDP now logs deprecation
removeOAuthService	POST /v1/settings.removeCustomOAuth (new)	add-oauth-service perm + twoFactorRequired
refreshOAuthService	POST /v1/settings.refreshOAuthServices (new)	add-oauth-service perm + twoFactorRequired

Implementation

• removeOAuthServiceMethod + refreshOAuthServiceMethod extracted from the DDP method files into exported functions, reused by both DDP entrypoints (now thin + deprecation-logged) and the REST handlers.
• Same add-oauth-service permission check + twoFactorRequired gate as the existing settings.addCustomOAuth endpoint.

Client changes

OAuthGroupPage.tsx swapped from three useMethod hooks to three useEndpoint hooks. addOAuthService now sends { name }; removeOAuthService now sends { name }.

Test plan

• CI green (lint + typecheck)
• Admin → OAuth → Add custom OAuth → fill name → modal closes, settings group appears
• Admin → OAuth → Remove custom OAuth (confirm danger modal) → settings group disappears, settings rows deleted
• Admin → OAuth → Refresh OAuth services → toast OK, login page reflects updated providers
• Hit endpoints with curl and confirm 401/403 without the add-oauth-service perm, 2FA prompt without a valid 2FA challenge

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added REST API support for removing custom OAuth services.
  • Added REST API support for refreshing OAuth service configurations.
  • Completed the custom OAuth administration workflow with consistent authentication, permission, and two-factor checks.

• Updates

  • The OAuth administration page now uses the REST endpoints for adding, removing, and refreshing services.
  • Legacy DDP methods remain available temporarily with deprecation notices.

Task: ARCH-2270