Provision YustUser after OAuth redirect sign-in (completeSignInWithRedirect)

[CLNMR]

Problem

On web, OAuth sign-in with redirect: true uses Firebase's signInWithRedirect, which navigates the whole page away to the identity provider and reloads the app on return. That reload discards the in-flight signInWith... call before it reaches the link/create logic, so _signInWithProvider never provisions a YustUser. Firebase restores the AuthUser from persistence, but the YustUser document is never created — leaving an authenticated Firebase user with no matching domain user.

This surfaced in the app as: Microsoft login on dev creates only an AuthUser, not a proper YustUser (dev/next/beta web use the redirect flow; prod uses popup and is unaffected).

Change

• Add completeSignInWithRedirect() to the auth service. On web it calls getRedirectResult() and, when a sign-in just completed, links or creates the matching YustUser (auth method derived from the provider id). It is a no-op when there is no pending redirect result (safe to call on every startup) and on non-web platforms.
• Extract the shared link/create logic into _provisionYustUser, reused by both _signInWithProvider and the new method.
• Add matching no-op completeSignInWithRedirect() overrides on the dart (server) and mocked services for interface parity.

Callers invoke completeSignInWithRedirect() once at app startup. The univelop side is in univelop#(see linked app PR).

Notes

• Idempotent: if the redirect user already has a YustUser (matched by authId), no duplicate is created.
• Version bumped to 3.35.0. (origin/master was at 3.33.2; there is unpublished local 3.34.0 WIP on some checkouts — this intentionally lands as 3.35.0 to avoid colliding with it and to match the app's ^3.35.0 constraint.)

🤖 Generated with Claude Code

[CLNMR]

App-side companion PR that calls this at startup: univelop/univelop#7728