fix(api): enforce atomic single-use authorization code redemption

[markwylde]

Summary

• enforce atomic compare-and-set consumption for authorization codes during token redemption
• reject concurrent or replayed code redemption attempts with invalid_grant
• add regression coverage for concurrent redemption in both public and confidential client flows
• add model-level tests for consumeAuthCode success/failure semantics
• update README, specs, and brochureware docs to reflect atomic single-use code redemption

Testing

• cd packages/api && npx tsx --test src/models/authCodes.test.ts
• cd packages/test-suite && PW_REPORTER=dot PW_ARTIFACTS=off npx playwright test tests/api/oidc-nonce-code-flow.spec.ts --reporter=dot --workers=1
• npm run tidy
• npm run build

Issue

• fixes Make authorization code redemption single-use and atomic #78