feat(management): provision position terminals atomically

[windischb]

Summary

• expose OAuth client creation to cookie and Management API bearer callers with live granular permission checks
• provision an existing or inline-created Position, terminal enrollment, and managed OAuth client atomically
• require a consumer-selected clientId and make identical retries idempotent while rejecting changed intent
• return a directly usable ShortGuid terminal id and never replay a one-time client secret
• document the consumer contract and permission model

Security

• terminal provisioning requires oauth-client:write and position:write
• linking or creating a Service Account additionally requires service-account:write
• the PositionTerminals feature flag remains the dark-launch boundary
• no stable Docker container or PostgreSQL instance was modified

Verification

• Release solution build passed
• 1,523 unit tests passed
• 714 API/integration tests passed
• frontend type-check and production build passed
• public and in-app VitePress builds passed
• git diff --check passed

No database migration or projection rebuild is required.