fix(auth): carry purgeAt on the native OIDC deletion-pending redirect

The web leg of the OIDC callback already names the purge date when the
account is pending deletion; the native leg redirected with the bare
reason. It now adds the same purgeAt parameter to the custom-scheme
redirect, and only the date.

Refs #1341

docs/api/openapi.yaml

@@ -4058,11 +4058,13 @@ paths:
             drives it rather than a client), which ends the native leg at `healthlog://oidc-callback` with
             `code=<hlh_…>`, with `mfa_ticket=<ticket>&methods=<list>`, or with `error=<reason>`, where reason is one of
             `oidc_disabled`, `oidc_rate_limited`, `oidc_denied`, `oidc_no_email`, `oidc_email_unverified`,
-            `oidc_identity_conflict`, `oidc_link_required`, `oidc_registration_disabled`, `oidc_failed`.
-            `oidc_link_required` means the provider's e-mail matches an existing local account that is not linked yet;
-            the owner links it by signing in once with that account's own password or passkey in a browser. The reasons
-            are this exact snake_case vocabulary on both legs; a client maps a value it does not know to a generic
-            sign-in failure.
+            `oidc_identity_conflict`, `oidc_link_required`, `oidc_registration_disabled`, `account_deletion_pending`,
+            `oidc_failed`. `oidc_link_required` means the provider's e-mail matches an existing local account that is
+            not linked yet; the owner links it by signing in once with that account's own password or passkey in a
+            browser. `account_deletion_pending` means the account is locked pending deletion; when the purge date is
+            known it rides beside the reason as `purgeAt=<ISO 8601 instant>` on both legs, and nothing else about the
+            account does. The reasons are this exact snake_case vocabulary on both legs; a client maps a value it does
+            not know to a generic sign-in failure.
   /api/auth/passkey/register-options:
     post:
       tags: