#9922 feat(apollo): add optional OAuth connections

Summary

• Add Apollo OAuth connections alongside existing saved and inline API keys.
• Support partner authorization, rotating refresh tokens, and self-hosted client setup; offer OAuth only when its client is configured and workspace policy permits it.
• Validate mixed credential pickers while preserving the existing API-key request path.

Type of Change

• New feature

Testing

• Apollo OAuth protocol and profile validation tests, including negative controls for URL encoding, provider identity, and response byte limits
• Saved-credential contract and sibling credential, block, and availability tests
• Live OAuth code exchange, profile verification, bearer-token API request, rotating refresh, and refreshed-token read (5/5 checks)
• Production app build and organization-search browser scenario (20 checks), plus redirect-classification negative controls
• Full repository lint, type-check, audits, tests, and block-registry checks

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)