fix: add PKCE to Mystira OIDC login

[JustAGhosT]

Summary

• generate a PKCE code verifier/challenge when starting Mystira Identity auth
• include code_challenge and code_challenge_method=S256 on the authorize redirect
• store the verifier in the short-lived OAuth state cookie and send code_verifier during token exchange

Validation

• pnpm exec eslint app/api/auth/callback/[provider]/route.ts lib/auth/identity-provider.ts
• pnpm run type-check
• pnpm exec prettier --check app/api/auth/callback/[provider]/route.ts lib/auth/identity-provider.ts

Live issue fixed

Mystira Identity rejected the authorize request with invalid_request: mandatory code_challenge parameter missing.