feat: handle OAuth errors with proper redirects
Replace JSON error responses in OAuth flows with proper redirects per
OAuth spec (RFC 6749 Section 4.1.2.1).
- Admin authorize: redirect to / or /onboarding with error params
- Admin callback: redirect with error params on token exchange failure
- Third-party authorize: redirect after redirect_uri validated
- Third-party callback: redirect to client with error params
- Client UI: display error messages from redirect params