[auth 2] Reconcile dynamic GoTrue redirects and Auth runtime rollout

[artiphishle]

Related roadmap issue: ankhorage/studio#190

Scope

This is the owning-package Infra release boundary for [auth 2]. Studio consumption and admin diagnostics must follow only after this package is merged and released.

What changed

• add a public environment-aware Auth redirect configuration model;
• derive provider callbacks as <gateway-origin>/auth/v1/callback;
• keep preview and production redirect allow-lists exact and wildcard-free;
• add narrowly scoped loopback callback patterns only for local environments;
• isolate Supabase OAuth rollout behavior in a dedicated Minikube Auth lifecycle module;
• derive GoTrue provider and app callbacks from the active project API_EXTERNAL_URL, SITE_URL, and callback route;
• include optional native callbacks through OAUTH_NATIVE_REDIRECT_URLS;
• update only non-secret redirect metadata on deployment/auth;
• force a GoTrue rollout restart and wait up to 600 seconds;
• fail Infra Up before its success message when credential reconciliation or the Auth rollout fails;
• keep built-in app and supabase namespaces canonical when lifecycle contributions are registered;
• add redirect-policy, multi-provider, concurrent-project, lifecycle-ordering, and secret-leakage coverage;
• add a minor changeset for the new public API.

Security

OAuth client secrets remain in trusted runtime secret resolution. Generated status output and lifecycle commands expose callback URLs and readiness only; they do not print client secrets, authorization codes, tokens, or service-role credentials.

Validation

CI is green on ac051c9d4aa82cc67e076e5acb373c4f63e68973:

• build;
• lint;
• format check;
• Knip;
• full Bun test suite;
• typecheck;
• changeset status.

Release boundary

Do not bridge this change into Studio with an unreleased workspace dependency. After this PR is merged and @ankhorage/infra is released, the Studio phase can update its dependency and surface the exact callback/rollout diagnostics.