Start or recover provider sign-in

Persist idempotency_key before sending and retry this exact endpoint and intent after response loss. Never fall back to the legacy unkeyed start, including on 404 from an older replica. Same-user recovery works across authorized OAuth clients but never transfers original grant authority. Receipt metadata survives login cleanup until workspace membership erasure. Retained results return current state; purged results return 410. Conflicting intent returns 409 without cancelling work. New intent requires a new UUID. Requires org:write and owner/admin user OAuth. Replay never extends expiry or repeats a provider exchange.

_{Scope: org:write}