refactor(integrations): start and end every OAuth connection through the kit

Minting the state, building the consent URL and dropping a grant each had a
copy per provider route. The routes keep their auth, rate limits and
redirects and hand the rest to one implementation, which the managed-profile
routes reuse.

src/app/api/oura/connect/route.ts

@@ -1,14 +1,10 @@
 import { apiHandler, requireAuth } from "@/lib/api-handler";
-import { annotate } from "@/lib/logging/context";
-import { shouldEmitSecureCookie } from "@/lib/auth/secure-cookie";
-import { checkRateLimit } from "@/lib/rate-limit";
-import { getAuthorizationUrl } from "@/lib/oura/client";
-import { getOuraClientCredentials } from "@/lib/oura/credentials";
 import {
-  OAUTH_STATE_TTL_MS,
-  mintSignedState,
-  oauthStateCookieName,
-} from "@/lib/oauth/signed-state";
+  setConnectStateCookie,
+  startOAuthConnect,
+} from "@/lib/integrations/oauth-kit/connect-start";
+import { annotate } from "@/lib/logging/context";
+import { checkRateLimit } from "@/lib/rate-limit";
 import { NextResponse } from "next/server";
 
 /**
@@ -45,8 +41,8 @@ export const GET = apiHandler(async () => {
     );
   }
 
-  const creds = await getOuraClientCredentials(user.id);
-  if (!creds) {
+  const started = await startOAuthConnect("oura", user.id);
+  if (!started.ok) {
     annotate({ action: { name: "oura.connect.no_credentials" } });
     return NextResponse.redirect(
       new URL(
@@ -56,16 +52,8 @@ export const GET = apiHandler(async () => {
     );
   }
 
-  const state = mintSignedState("oura", user.id);
-  const url = getAuthorizationUrl(state, creds);
-
-  const response = NextResponse.redirect(url);
-  response.cookies.set(oauthStateCookieName("oura"), state, {
-    httpOnly: true,
-    secure: shouldEmitSecureCookie(),
-    sameSite: "lax",
-    maxAge: Math.floor(OAUTH_STATE_TTL_MS / 1000),
-    path: "/",
-  });
-  return response;
+  return setConnectStateCookie(
+    NextResponse.redirect(started.authorizationUrl),
+    started.cookie,
+  );
 });

src/app/api/oura/disconnect/route.ts

@@ -1,11 +1,8 @@
-import { prisma } from "@/lib/db";
-import { Prisma } from "@/generated/prisma/client";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
-import { auditLog } from "@/lib/auth/audit";
+import { disconnectOAuth } from "@/lib/integrations/oauth-kit/disconnect";
 import { apiSuccess, apiError } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
 import { checkRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
-import { markDisconnected } from "@/lib/integrations/status";
 
 /**
  * v1.17.0 — disconnect Oura for the current user.
@@ -25,25 +22,9 @@ export const POST = apiHandler(async () => {
     });
   }
 
-  const dbUser = await prisma.user.findUnique({
-    where: { id: user.id },
-    select: { ouraAccessTokenEncrypted: true },
-  });
-  if (!dbUser?.ouraAccessTokenEncrypted) {
+  if ((await disconnectOAuth("oura", user.id)) === "not_connected") {
     return apiError("No Oura connection", 404);
   }
 
-  await prisma.user.update({
-    where: { id: user.id },
-    data: {
-      ouraAccessTokenEncrypted: null,
-      ouraRefreshTokenEncrypted: null,
-      ouraScopeDenied: Prisma.DbNull,
-    },
-  });
-
-  await auditLog("oura.disconnect", { userId: user.id });
-  await markDisconnected(user.id, "oura");
-
   return apiSuccess({ disconnected: true });
 });