Add OAuth team selection for multi-team accounts (MCP)

Multi-team accounts connecting an OAuth/MCP client (e.g. Claude) had no
way to specify a team: the only mechanism was the X-Sendlit-Team-Id
header, which generic OAuth clients never send, so every /mcp call hit
require-team.ts's 409 team_required response right after authorizing.

Adds a "select a team" step to the OAuth flow via oauth-provider's
postLogin hook, shown only for multi-team accounts (mirrors Notion's
workspace picker) — the choice is threaded through as the OAuth
referenceId and lands on the minted access token as a team_id claim,
which resolve-auth.ts now re-validates as live membership before
trusting. Single-team accounts are unaffected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Rajat

apps/api/drizzle/0011_little_shooting_star.sql

@@ -0,0 +1,17 @@
+CREATE TABLE IF NOT EXISTS "oauth_post_login_team_selections" (
+	"session_id" text PRIMARY KEY NOT NULL,
+	"team_id" uuid NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now()
+);
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "oauth_post_login_team_selections" ADD CONSTRAINT "oauth_post_login_team_selections_session_id_auth_session_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."auth_session"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "oauth_post_login_team_selections" ADD CONSTRAINT "oauth_post_login_team_selections_team_id_teams_id_fk" FOREIGN KEY ("team_id") REFERENCES "public"."teams"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;