fix: preserve OAuth integrity during source purge

[jalehman]

What

Make expired-source purge reconcile retained OAuth client metadata before deleting a source, while preserving active client authority and fail-closed read scope.

Why

Soft-revoked OAuth client rows are retained for audit, but their restrictive source foreign keys caused the nightly dream purge phase to fail after substantive work had completed. Active clients also need protection from both deleted authority targets and accidental read-scope widening.

Changes

• Lock purge candidates transactionally
• Preserve active OAuth authority references
• Clear revoked clients' dead bindings
• Shrink federated reads without widening access
• Add production-shaped lifecycle regressions
• Document the purge authorization contract

Testing

• bun test test/destructive-guard.test.ts — 25 pass, 0 fail
• bun run verify — 31 checks pass
• autoreview --mode branch --base origin/master — clean
• bun run test — non-green: four shards hit the 25-minute timeout; four unrelated embedding-dimension failures passed when isolated, while two unchanged test-runner self-tests remained failing