feat: add PKCE OAuth boundary

Introduce provider-neutral HTTP contracts and public-client authorization-code orchestration with PKCE S256, strict HTTPS and loopback validation, constant-time state checks, secure OpenSSL entropy, and single-send token exchange semantics.

Add independent protocol and adversarial suites covering RFC 7636, RFC3986 encoding, callback failures, response redaction, and no-retry behavior. Concrete networking, browser/listener, token parsing, Secret Service, and Graph integration remain separate follow-up slices.

meson.build

@@ -13,6 +13,7 @@ project(
 
 inc = include_directories('include')
 sqlite = dependency('sqlite3')
+libcrypto = dependency('libcrypto')
 threads = dependency('threads')
 nocal_sources = files(
   'src/domain/calendar_transfer.cpp',
@@ -21,15 +22,16 @@ nocal_sources = files(
   'src/domain/month_layout.cpp',
   'src/storage/ics_store.cpp',
   'src/storage/sync_cache.cpp',
+  'src/sync/oauth.cpp',
   'src/tui/Screen.cpp',
   'src/tui/EventEditor.cpp',
   'src/tui/Terminal.cpp',
   'src/tui/TuiApp.cpp',
 )
 nocal_lib = static_library('nocal-core', nocal_sources, include_directories: inc,
-  dependencies: sqlite)
+  dependencies: [sqlite, libcrypto])
 nocal_dep = declare_dependency(include_directories: inc, link_with: nocal_lib,
-  dependencies: sqlite)
+  dependencies: [sqlite, libcrypto])
 
 nocal_executable = executable('nocal', 'src/main.cpp',
   dependencies: nocal_dep, install: true)
@@ -46,6 +48,12 @@ test('ics-storage', ics_tests)
 sync_cache_tests = executable('sync-cache-tests', 'tests/sync_cache_tests.cpp',
   dependencies: [nocal_dep, threads])
 test('sync-cache', sync_cache_tests)
+oauth_tests = executable('oauth-tests', 'tests/oauth_tests.cpp',
+  dependencies: nocal_dep)
+test('oauth', oauth_tests)
+oauth_security_tests = executable('oauth-security-tests',
+  'tests/oauth_security_tests.cpp', dependencies: nocal_dep)
+test('oauth-security', oauth_security_tests)
 tui_tests = executable('tui-tests', 'tests/tui_tests.cpp',
   dependencies: nocal_dep)
 test('tui', tui_tests)