Support customer-managed Cloudflare OAuth

[olegberman]

Summary

• keep the official HQBase OAuth relay as the default
• add a customer-managed private OAuth client mode using direct Cloudflare authorization with PKCE
• add installer and operator configuration without API tokens or client secrets
• exercise direct OAuth in staging and disable Worker invocation logs

Validation

• CI=true pnpm check
• CI=true pnpm deploy:dry-run
• git diff --check

Dependencies

Merge the contract and OAuth relay PRs first. The staging environment also needs HQBASE_E2E_OAUTH_CLIENT_ID before the staging E2E run.