fix(#512): harden OAuth document recovery lifecycle

[BorisTyshkevich]

Summary

Follow-up to #527 addressing the post-merge recovery lifecycle review.

• fence deferred automatic recovery with a versioned live-document fingerprint, retaining changed sessions and offering an explicit Restore drafts action
• retain workspace-mismatched checkpoints and callback authority so navigating away and back cannot delete recovery
• make OAuth redirect preparation transactional across recovery checkpoint/marker, IdP, origin, verifier, state, and return route
• preserve unrelated pending retry authority on callback mismatch
• version the expanded callback marker wire format and reconcile the Unreleased changelog

Root cause

The original retry gate treated clean dirty flags as proof that the live document session had not changed, workspace mismatch was classified as terminal, and redirect rollback owned only the three legacy PKCE attempt keys. Those boundaries were narrower than the full recovery/OAuth transaction.

User impact

Newer saved or reorganized work is no longer replaced automatically by a stale checkpoint. Switching workspaces no longer deletes another workspace recovery copy. Failed redirect assignment restores the complete prior OAuth/recovery transaction.

Validation

• npx tsc --noEmit
• npm test — 6,426 tests passed; 100% statements/lines and repository coverage gates passed
• npm run build
• targeted OAuth recovery and connection-session regression tests