Mint an OAuth authorization URL for git-provider connect

Returns a per-provider OAuth authorization URL plus a signed state token. Headless flow:

1. Headless agent POSTs { provider }.
2. Gateway returns { authorization_url, state, expires_at }.
3. Agent surfaces the URL to a human (Slack DM, console output, etc.).
4. Human clicks; provider redirects to the dashboard OAuth callback.
5. Callback validates the state token and writes the git_connection row.
6. Agent polls GET /v1/apps/:appId/git until { connected: true }.

The state token is HMAC-signed (10-minute TTL) and binds the OAuth callback to the originating app + tenant + provider. Each call mints a fresh nonce — no replay across attempts.

Returns 503 git_connect_not_configured when provider OAuth is unusable on this environment (e.g. GITLAB_CLIENT_ID not set, or the GitHub App slug cannot be resolved from GET /app).