Link Provider

Attach a sign-in provider to the current account: start a link-mode OAuth round-trip. This adds a way to sign in to ONE account; counting two accounts as one owner is an identity link (/identity-links).

The OAuth round-trip is the fresh re-auth — there is no password prompt, which is the locked re-auth contract for OAuth-only users (edge case 1). The existing /auth/{provider}/callback reads oauth2_state_intent:{state} == "link" and binds the returned identity to oauth2_state_user:{state} via AccountLinkingService — only when the callback arrives with the session cookie pinned under oauth2_state_session:{state} here, so the authorization_url is of no use to any other browser.

Returns: JSON with authorization_url (frontend redirects to it) and the CSRF state token.

Raises: HTTPException(401): no session cookie on the request (SessionUser is browser-session only, so this is a contradiction). HTTPException(500): auth managers not initialised, OAuth2 manager missing, or a required env var (GOOGLE_REDIRECT_URI / GITHUB_CLIENT_ID) is missing.