feat: add PKCE OAuth boundary

Introduce provider-neutral HTTP contracts and public-client authorization-code orchestration with PKCE S256, strict HTTPS and loopback validation, constant-time state checks, secure OpenSSL entropy, and single-send token exchange semantics.

Add independent protocol and adversarial suites covering RFC 7636, RFC3986 encoding, callback failures, response redaction, and no-retry behavior. Concrete networking, browser/listener, token parsing, Secret Service, and Graph integration remain separate follow-up slices.

docs/ROADMAP.md

@@ -35,10 +35,21 @@ Completed cache foundation:
 - Normalized event instances for immutable snapshots
 - Reserved transactional outbox and conflict records for later remote writes
 
+Completed HTTP/OAuth boundary:
+
+- Generic injected HTTP transport and deterministic fakes, with retries left to
+  provider operations
+- Public-desktop OAuth authorization code design with PKCE `S256`, system
+  browser, and loopback redirect
+- Multitenant Microsoft account audience and delegated least-privilege
+  `Calendars.Read`; tenant policy may still require administrator consent or
+  block user consent
+- No client secret in the open-source desktop binary
+
 Next provider-boundary slices:
 
-- Injectable HTTP, PKCE authentication, and deterministic fake transports
-- Secret Service credentials; OAuth secrets are never stored in SQLite
+- Concrete HTTP, browser/loopback, token JSON, and Secret Service adapters
+- OAuth secrets in Secret Service, never SQLite
 - Generic `SyncProvider` contract and observable sync status
 
 ## 0.3 — CalDAV
@@ -54,10 +65,12 @@ Next provider-boundary slices:
   ETag-aware remote writes after the conflict boundary is proven
 - Account/calendar management UI and per-calendar ANSI identity
 
-The current cache work is only the prerequisite durable boundary. No network,
-OAuth, or Graph synchronization is implemented in that phase. After the cache
-passes its verification gates, the immediate sequence is injectable HTTP plus
-PKCE and fake transports, then read-only Microsoft Graph delta synchronization.
+The cache and generic HTTP/OAuth boundaries are prerequisites, not usable
+Microsoft 365 integration. The boundary phase has no concrete HTTP transport,
+real browser/loopback adapter, token parser, Secret Service backend, Graph call,
+or account setup. The immediate sequence is concrete desktop, HTTP, and Secret
+Service adapters, then read-only Microsoft Graph discovery and delta
+synchronization.
 
 ## 1.0 — distribution quality