feat(#512): restore dirty documents after OAuth reauthentication (phase 3)

[BorisTyshkevich]

What & why

Closes #512

This final Phase 3 PR completes the architecture adopted across #512:

• Phase 1 made connection lifecycle state explicit and authoritative.
• Phase 2 separated the persistent document session from the disposable authenticated execution scope, resolving the general auth-loss failure behind onAuthLost bypasses mandatory authenticated-session teardown #502 (and Basic-mode teardown requests (KILL QUERY/export-cancel) get the wrong Authorization scheme after credentials clear #520/Detached-view (Data Pane Expand) refresh failure never reports auth loss #522), rather than treating a single query path as special.
• Phase 3 crosses OAuth's unavoidable page navigation with a versioned, state- and workspace-bound sessionStorage recovery checkpoint. It restores authored dirty tabs only after the successful callback has loaded the committed workspace, reconciled linked query tabs, and revalidated raw Specs before the first signed-in render.

The checkpoint intentionally contains authored document state only: tab order/identity and bindings, SQL and raw Spec drafts, editor mode, dirty flags, and reconciliation metadata. It never stores passwords, OAuth tokens, results, ClickHouse sessions, result metadata, or running/export state. Its 15-minute TTL is an eligibility bound; malformed, unsupported, expired, workspace-mismatched, and callback-mismatched data fails closed into normal bootstrap.

Basic recovery remains entirely in-shell: it resumes the same RAM document session and resets/clears the reusable password form after success. OAuth re-enables the same in-shell action once the durable pre-redirect transaction is available. Snapshot failure prevents navigation and retains the ordinary dirty-page guard. After a durable write, only the exact intentional redirect consumes the one-shot unload bypass; reloads, closes, unrelated navigation, and failed writes still warn.

Failed OAuth callbacks retain the authored checkpoint and retry only rebinds its OAuth attempt state. A separate tab-scoped validated-callback marker carries only state plus validation time: a checkpoint is never retry authority. Pending valid recovery suppresses legacy oauth_shared seeding rather than merging the two. It restores only after authoritative workspace load, never overwrites newer save-relevant dirty RAM, and retires the marker before publication. Explicit Log out clears both checkpoint and marker.

Evidence

• npm test: 193 files, 6,425 tests; 100% statements and lines
• npm run types: passed
• npm run check:arch: 96/8 passed
• npm run build: passed; dist/sql.html 2,073,371 bytes
• Hardened Chromium recovery flow: 3/3 passed
• Independent lifecycle/auth/security and integration reviews: clear

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• No new runtime dependency
• README / CHANGELOG.md ([Unreleased]) updated for the changed authentication/session surface
• Reconciled affected tracked work: Preserve the document session across ClickHouse auth loss and reauthentication #512, Roadmap to 1.0.0 #68, related onAuthLost bypasses mandatory authenticated-session teardown #502/Basic-mode teardown requests (KILL QUERY/export-cancel) get the wrong Authorization scheme after credentials clear #520/fix(#502): run mandatory authenticated-session teardown on involuntary auth loss too #521/Detached-view (Data Pane Expand) refresh failure never reports auth loss #522, architecture and login documentation