Begin per-user OAuth consent for an oauth_passthrough connection.

Starts the per-user warehouse OAuth flow (DVT-123): mints a PKCE verifier + CSRF state, seals them (with the caller's identity) into a short-lived cookie, and redirects the browser to the connection's configured IdP authorize endpoint. Unlike the admin connection-metadata endpoints, consent is a per-user self-service action available to any member — each user grants only their OWN warehouse identity.

This is a top-level browser navigation, not an XHR (it ends in a cross-site redirect). On the IdP callback the code is exchanged for the user's refresh token, stored envelope-encrypted in user_connection_grants. Only valid for an oauth_passthrough connection whose admin has configured the oauth block and stored the client secret.