feat(card): switch Baanx login to OAuth code [PERA-4349]

[yasincaliskan]

Description

• OAuth flow: PKCE (verifier + S256 challenge, RFC 7636-tested) and CSRF state; initiate + code exchange via the Pera backend proxy, login/authorize/ refresh direct to Baanx. If the exchange fails, login degrades to the old
  refresh-less 6h session instead of failing.
• 2FA: new POST /v1/auth/login/otp support — the sign-in screen now requests the code on isOtpRequired and resends via the endpoint instead of re-running login.
• Registration: the address-finalize step runs the same exchange, so new users get refresh tokens too.
• Transport: 401→refresh interceptor keys on authenticated calls; card proxy requests attach the app-integrity token, or the staging bypass header on non-production builds.
• Cleanups: toUrlSafeBase64 consolidated into shared, getValidIntegrityToken extracted into app-integrity (reused by fee-delegation).

Related Issues

• https://algorandfoundation.atlassian.net/browse/PERA-4349

Checklist

• Have you tested your changes locally?
• Have you reviewed the code for any potential issues?
• Have you documented any necessary changes in the project's documentation?
• Have you added any necessary tests for your changes?
• Have you updated any relevant dependencies?

[yasincaliskan]

It'll be ready for testing when we add INTEGRITY_BYPASS_ENABLED=true into staging backend
cc: @kadircancetin