refactor: remove PKCE from OIDC flow (confidential client)

Backend holds client_secret and does the token exchange server-side,
making PKCE redundant. Removes code_verifier/code_challenge from all
frontend auth paths and backend exchange method. Eliminates the source
of "grant request is invalid" errors from verifier mismatches.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/schema.d.ts

@@ -1615,7 +1615,6 @@ export interface components {
         CallbackRequest: {
             code?: string;
             redirectUri?: string;
-            codeVerifier?: string;
         };
         LoginRequest: {
             username?: string;