Start an OAuth flow in LINK mode (attach to the current principal)

Authenticated + step-up (authenticator.register). Returns the provider authorize URL for a flow whose callback attaches the resulting Google/GitHub identity to the CURRENT principal — including an owner-capable one (the explicit confirmed link that completes needs_confirmation). If the identity is already actively bound to a DIFFERENT principal, the callback lands on the console's merge guidance (#oauth_link_conflict) instead of logging the browser into that principal.