Add secure Lumin loopback OAuth helper

[silverstein]

Summary

• add an internal IPv4 loopback OAuth callback for the Lumin public PKCE client
• bind an ephemeral 127.0.0.1 port to the exact registered /callback path
• enforce PKCE S256, independent state, one-use callback and token exchange, strict callback validation, response bounds, and exact scope preservation
• mirror and package the helper without registering a new MCP tool or enabling provider transport

This PR is stacked on #181, which adds the disabled Lumin Sign v1 request mapper.

Verification

• focused and adjoining tests: 104/104 passed
• exact-lock affected rerun: 111/111 passed
• extraction Phase 1 isolated control: 21/21 passed
• Node-native partition: 61 passed, 10 intentional platform skips
• reproducible share contract passed with 51 tools, 14 prompts, and 122 licensed components
• MCPB built twice byte-identically, SHA-256 646b7235962f19179b16daa9f8c91a4583a8fb3f16175614ba434e3ffb03ec7d
• packed MCPB smoke passed

Qualification

The VM-wide aggregate is not claimed green. Two existing malformed-PDF mutation sweeps each exceeded their fixed 180-second timeout even in isolation. A later aggregate reran those cases despite a command-line exclusion and was killed by the host with exit 137 after 22 minutes. No Lumin-specific, mirror, inventory, package, or smoke check failed.

No OAuth endpoint, signing request, credential persistence, provider action, release, or production activation occurred.