feat(claim): hand over a managed profile through single sign-on

POST /api/auth/claim/sso checks the handover link and the username and seals
the link id, the username and a per-start binding into an hl_claim cookie.
GET /api/auth/oidc/login?intent=claim carries the binding into the encrypted
OIDC state, and the callback binds the provider subject to the profile in the
claim transaction, refusing a subject or verified email another account
holds, a link that is no longer usable, and a live session.

The handover status and the claim preview name the redemption methods; a
single-sign-on-only server hands over through the identity provider, and only
the password claim stays refused there.

tests/integration/managed-profile-handover.test.ts

@@ -811,7 +811,7 @@ describe("claiming the profile", () => {
     // cookie jar, and the race is between the two transactions, not cookies.
     const [claimed, minted] = await Promise.allSettled([
       claimManagedProfile({
-        rawToken: first,
+        link: { rawToken: first },
         username: "racer",
         email: "racer@example.test",
         passwordHash: "hash",