Implement OIDC nonce storage and validation in auth code flow

[markwylde]

Summary

The authorization flow accepts nonce but does not persist or validate it when issuing ID tokens.

Evidence

• packages/api/src/controllers/user/authorize.ts accepts nonce but does not store it in pending auth state.
• packages/api/src/controllers/user/token.ts does not include/validate nonce during ID token issuance.

Security Impact

Without nonce binding, ID tokens can be replayed or mixed-up across authorization responses, violating OIDC Core nonce requirements.

Required Fix

• Persist nonce with the original authorization request/code.
• On code redemption, require exact nonce match before minting ID token.
• Include nonce claim in ID token when provided by the original request.

Acceptance Criteria

• Authorization code metadata contains nonce (when supplied).
• Token endpoint rejects mismatched/missing expected nonce conditions.
• ID token includes correct nonce claim for nonce-bearing auth requests.
• Tests cover success and failure paths for nonce validation.

Source

Security Review dated 2026-02-15, Finding 1 (Critical).

[markwylde]

Implemented in #82.

What this PR covers:

• Persists nonce from /authorize through pending_auth and auth_codes.
• Emits stored nonce in id_token during authorization code redemption.
• Keeps /token standards-compliant by sourcing nonce from stored authorization state (not client token request input).
• Adds API tests for persistence and claim behavior.
• Adds end-to-end test-suite coverage for /authorize -> /authorize/finalize -> /token nonce flow.

This should resolve the core nonce-binding gap identified in this issue once merged.