feat(auth): add bounded mobile PKCE engine

[tcballard]

Summary

Adds the provider-neutral authorization-code PKCE engine for native mobile account connections.

Scope

• defines normalized account-authentication modes and bounded readiness snapshots
• generates secure S256 state/verifier challenges
• validates exact callback ownership, state, and single authorization codes
• performs bounded JSON or form token exchanges
• writes the returned credential directly to the existing device-only Keychain store
• adds deterministic fake-provider tests for success and failure boundaries

Product / Architecture Decisions

• SwiftUI receives only an authorization URL, callback scheme, provider ID, and opaque challenge ID.
• PKCE verifiers and returned credentials remain actor-owned and never enter AppModel or view state.
• The shared engine does not approve or enable any provider by itself; provider adapters remain separately reviewed stack layers.
• Existing macOS credential and ChatGPT/Codex boundaries are unchanged.

User-Facing Contract

No account button is enabled by this PR. It establishes the secure lifecycle used by later approved account adapters.

Verification

• XcodeBuildMCP signed iPhone 17 simulator suite: 62 passed, 0 failed, 0 skipped
• PKCE coverage includes S256 construction, exact callbacks, state mismatch, duplicate codes, denial, cancellation, malformed/rejected/oversized exchanges, Keychain readiness, and sign-out
• git diff --check

Review Path

1. designs/WF-DESIGN-0019-mobile-providers-accounts-and-credentials.md
2. ios/WayfinderIOS/WayfinderIOS/AuthorizationCodePKCE.swift
3. ios/WayfinderIOS/WayfinderIOSTests/AuthorizationCodePKCETests.swift

Notes For Reviewer

This is stacked on codex/ios-provider-model-inventory. Review and merge PRs #123, #124, and #125 first.

AI-assisted implementation; tests and repository state were verified locally.