fix(idp): apply PKCE when building OAuth and OIDC providers (#12247)

# Which Problems Are Solved

- IDP intent authorization redirects used by Login v2 ignored the
configured `UsePKCE` setting for Generic OAuth providers
- This caused providers such as X/Twitter OAuth2 to receive
authorization requests without `code_challenge` and
`code_challenge_method`
- OIDC provider construction had the same gap, even though PKCE is
already part of the provider configuration model
- Existing IDP intent redirect tests expected non-PKCE OAuth URLs and
failed once PKCE was applied correctly

# How the Problems Are Solved

- Updated `OAuthIDPWriteModel.ToProvider` in
internal/command/idp_model.go to pass `rp.WithPKCE(nil)` when `UsePKCE`
is enabled
- Updated `OIDCIDPWriteModel.ToProvider` to apply the same PKCE
relying-party option for OIDC providers

# Additional Changes

- Added focused provider-construction tests covering:
    - OAuth provider redirects include code_challenge
    - OIDC provider redirects include code_challenge
    - both providers use code_challenge_method=S256
    - both persist the generated codeVerifier for token exchange
- Updated `TestCommands_AuthFromProvider` in
internal/command/idp_intent_test.go so OAuth redirect assertions verify
PKCE structurally instead of hard-coding the generated challenge value

# Additional Context

- Reproduced with X/Twitter OAuth2 where the generated authorization URL
was missing PKCE parameters despite `usePkce: true`
- Verified both the focused PKCE tests and the full unit test suite run
successfully with the fix
- Closes #12036 
- Closes/supersedes #12054:
  - Tests are included
  - No slice re-allocation on `opts` append
  
# Result

### Before

`authUrl` in `StartIdentityProviderIntent` response is missing
`code_challenge` and `code_challenge_method` for Generic OAuth IDP with
PKCE enabled:
```json
{
    "details": {
        "sequence": "1",
        "changeDate": "2026-06-07T18:48:16.921317Z",
        "resourceOwner": "376298239768395779"
    },
    "authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417136207200259"
}
```

### After

`code_challenge` and `code_challenge_method` are correctly included into
`authUrl`:

```json
{
    "details": {
        "sequence": "1",
        "changeDate": "2026-06-07T18:49:39.488941Z",
        "resourceOwner": "376298239768395779"
    },
    "authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&code_challenge=8G4vN8QNgSsbvGSHKwYPEc2qUYU2BK5L0fsr992duTA&code_challenge_method=S256&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417274736672771"
}
```

internal/command/idp_intent_test.go

@@ -439,8 +439,9 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 		samlRootURL string
 	}
 	type res struct {
-		auth idp.Auth
-		err  error
+		auth       idp.Auth
+		expectPKCE bool
+		err        error
 	}
 	tests := []struct {
 		name   string
@@ -585,7 +586,8 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 				callbackURL: "url",
 			},
 			res{
-				auth: &idp.RedirectAuth{RedirectURL: "auth?client_id=clientID&prompt=select_account&redirect_uri=url&response_type=code&state=id"},
+				auth:       &idp.RedirectAuth{RedirectURL: "auth?client_id=clientID&prompt=select_account&redirect_uri=url&response_type=code&state=id"},
+				expectPKCE: true,
 			},
 		},
 		{
@@ -647,7 +649,8 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 				loginHint:   "[email protected]",
 			},
 			res{
-				auth: &idp.RedirectAuth{RedirectURL: "auth?client_id=clientID&login_hint=user%40example.com&redirect_uri=url&response_type=code&state=id"},
+				auth:       &idp.RedirectAuth{RedirectURL: "auth?client_id=clientID&login_hint=user%40example.com&redirect_uri=url&response_type=code&state=id"},
+				expectPKCE: true,
 			},
 		},
 		{
@@ -755,13 +758,44 @@ func TestCommands_AuthFromProvider(t *testing.T) {
 			var got idp.Auth
 			if err == nil {
 				got, err = session.GetAuth(tt.args.ctx)
-				assert.Equal(t, tt.res.auth, got)
 				assert.NoError(t, err)
+				if tt.res.expectPKCE {
+					assertRedirectAuthWithPKCE(t, tt.res.auth, got)
+					assert.NotEmpty(t, session.PersistentParameters()[oauth.CodeVerifier])
+				} else {
+					assert.Equal(t, tt.res.auth, got)
+				}
 			}
 		})
 	}
 }
 
+func assertRedirectAuthWithPKCE(t *testing.T, expected, actual idp.Auth) {
+	t.Helper()
+
+	expectedRedirect, ok := expected.(*idp.RedirectAuth)
+	require.True(t, ok)
+	actualRedirect, ok := actual.(*idp.RedirectAuth)
+	require.True(t, ok)
+
+	expectedURL, err := url.Parse(expectedRedirect.RedirectURL)
+	require.NoError(t, err)
+	actualURL, err := url.Parse(actualRedirect.RedirectURL)
+	require.NoError(t, err)
+
+	actualQuery := actualURL.Query()
+	assert.NotEmpty(t, actualQuery.Get("code_challenge"))
+	assert.Equal(t, "S256", actualQuery.Get("code_challenge_method"))
+
+	actualQuery.Del("code_challenge")
+	actualQuery.Del("code_challenge_method")
+
+	assert.Equal(t, expectedURL.Scheme, actualURL.Scheme)
+	assert.Equal(t, expectedURL.Host, actualURL.Host)
+	assert.Equal(t, expectedURL.Path, actualURL.Path)
+	assert.Equal(t, expectedURL.Query(), actualQuery)
+}
+
 func TestCommands_AuthFromProvider_SAML(t *testing.T) {
 	type fields struct {
 		eventstore   func(t *testing.T) *eventstore.Eventstore