Bind OAuth checks to providers

OAuth security cookies (state, nonce, PKCE) now store the provider ID that created them and validate that the same provider is handling the callback, preventing cross-provider cookie misuse. This adds provider-specific validation to the cookie parsing logic with corresponding test coverage.