feat: OAuth middleware with module loaders for identity/secrets/auth config

Replace manual SQL queries and hardcoded schema assumptions in OAuth
middleware with module loaders from express-context:

New loaders:
- encryptedSecretsLoader: resolves encrypted_secrets schema from
  metaschema_modules_public.encrypted_secrets_module
- userAuthLoader: resolves user_auth_module for sign_in/sign_up
  function names and schema (no longer assumes privateSchema)
- identityProvidersLoader: resolves identity_providers_module for
  provider config table location

OAuth middleware changes:
- Uses req.constructive.useModule() for all schema lookups
- Uses req.constructive.withPgClient() for properly scoped RLS
  transactions (replaces manual set_config calls)
- Removes express-rate-limit (DB already handles rate limiting)
- Uses getNodeEnv() instead of process.env.NODE_ENV
- Extracts email_verified from raw provider profile data
- Passes loaders registry to createContextMiddleware in server.ts

Addresses review comments from PR #1141.

Author: pyramation

graphql/server/package.json

@@ -46,6 +46,7 @@
     "@constructive-io/express-context": "workspace:^",
     "@constructive-io/graphql-env": "workspace:^",
     "@constructive-io/graphql-types": "workspace:^",
+    "@constructive-io/oauth": "workspace:^",
     "@constructive-io/s3-utils": "workspace:^",
     "@constructive-io/upload-names": "workspace:^",
     "@constructive-io/url-domains": "workspace:^",