fix(oauth): require management auth on the OAuth login and connection routes

[HouMinXi]

Summary

/api/oauth/ is on the public route list so the authz pipeline leaves the
decision to each handler. Several handlers checked isAuthenticated(), and for
a public path that helper does not treat the request as a management call, so
any valid client API key passes, with no scope check and even when the key is
sent in the query string. A key issued only for inference could then start
device and browser logins, import tokens, paste credentials and poll flows to
completion, which creates provider connections or overwrites an existing one
by connectionId or matching email. That lets the key holder put an account
they control into the provider pool, or replace the operator's credentials.

The import routes in the same directory (codex, cursor, kiro, trae,
cliproxy) already call requireManagementAuth(). Use it in the remaining
handlers too, so they accept the same credentials as the rest of the
connection API: a dashboard session, the local CLI token, a scoped access
token, or an API key with the manage scope. An invalid key still gets 401 as
before; a valid key without the manage scope now gets 403.

requireManagementAuth also stopped short on a public path before a password
exists: isAuthRequired() answers "no auth needed" for any public path in that
window, so a remote caller passed the check on an unconfigured instance. It
now judges a public path as a management path, which leaves the window open
to the local operator only. The modals that call these routes read the error
through a shared helper, since the 401 and 403 bodies are objects. The static
guard test now covers every route in the directory and rejects isAuthenticated().

Related Issues

• None. This fixes a defect found by review, not a filed issue.

Validation

• Change type: other
• Focused tests: tests/integration/security-hardening.test.ts, tests/unit/oauth-routes-manage-scope.test.ts
• npm run lint
• Reconciled with the current active release base
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/integration/security-hardening.test.ts
• tests/unit/oauth-routes-manage-scope.test.ts

Coverage Notes

• The change is covered by the test files listed above. No coverage drop is expected; the new tests exercise the paths this PR adds.

Reviewer Notes

• The OAuth login and connection routes now require a management key. Inference-only keys that previously called them will get 401.