RED phase for Task 3: - Test 1: linkOidcToUser updates users.oidc_iss/sub and deletes local_credentials - Test 2: linkOidcToUser throws OidcLinkConflictError on conflict, no local_cred deletion - Test 3: POST /api/me/link-oidc returns initiation payload (state / authorizationUrl)