Backend review fixes (stages B3/B4): OAuth state cleanup, callback error mapping, MCP arg parsing ...

- /auth/login and /auth/callback purge expired OAuthState rows
  opportunistically (the table previously only grew)
- /auth/callback maps token-exchange/user-fetch failures to a clean
  502 AppError instead of an unhandled traceback
- legacy MCP adapter parses offset/limit through a bounded clamped
  parser (garbage arguments are 400, not a 500)
- webhook body decodes invalid utf-8 with replacement bytes, which can
  only fail the signature check (401) instead of a 500
- tests: 78 -> 80

Co-Authored-By: Claude Code <noreply@anthropic.com>

Webhook: accept trailing-slash target, 401 on bad signature, global_logout ends sessions ...

POST /webhooks/gnexus-auth/ (the spelling the auth platform had stored)
never redirected: the GET SPA catch-all matched the path and answered
405 allow:GET, so the platform's auth.global_logout deliveries kept
retrying and creds sessions outlived a global logout. Register both
spellings, return 401/400 on signature/payload failures instead of an
unhandled 500, and on auth.global_logout delete every session row of the
targeted user (other users' sessions untouched; API tokens long-lived
by design and revoked explicitly).

Co-Authored-By: Claude Code <noreply@anthropic.com>

Per-service locale override: effective locale chain, PATCH /me validation ...

users.locale is now purely the per-service override chosen in settings;
the auth-derived default lives in users.profile.locale and is never
written back over the override by login or the webhook. PATCH /me
normalizes language tags (en-US -> en), accepts auto to clear, and
rejects unsupported locales with 422. UserRead gains locale_effective
(override -> profile -> en) which the web UI and the extension use as
their UI language. The validation error handler strips non-serializable
pydantic ctx.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Production-ready rewrite: UI kit integration, admin backups, sorting, profile editing, and security hardening ...

- Frontend: complete rewrite using gnexus-ui-kit components (GnNavigationShell,
  GnTable, GnTimeline, GnModal, GnToastProvider, GnSkeleton, etc.)
- Frontend: browser route sync (/secrets/:id, /audit/:id), pagination,
  real-time search debounce, skeleton loading states, retry with backoff
- Frontend: profile editing modal, token creation with scope selection,
  import/export, settings metrics, admin users table
- Backend: backup/restore endpoints for PostgreSQL and SQLite via pg_dump/psql
- Backend: admin backup CRUD, file download endpoint
- Backend: stats endpoint, PATCH /me profile endpoint, CORS middleware,
  graceful shutdown logging
- Backend: table sorting (sort_by/sort_dir) in list_secrets
- Backend: OAuth return_to validation, rate limiting on sensitive endpoints
- MCP: validation fixes, tool description improvements, protocol cleanup
- Tests: 44 passing including new backup test suite
- Docker: add postgresql-client, backups volume, deployment docs
- Docs: backup/restore instructions in deployment guide

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix OAuth callback expiry handling

Implement initial gnexus-creds MVP scaffold