[Bccorb]

Atomic refresh consume for the OpenID Provider (epic #387).

Stacked on #537. Uses @seamless-auth/types 0.34.0-next.4 (fells-code/seamless-auth-types#139 adds the response schema).

What changed

• POST /oidc/payloads/:model/:id/consume answers 200 { consumed } instead of 204.
• consumeOidcPayload sets consumedAt in one UPDATE ... WHERE "consumedAt" IS NULL AND "expiresAt" > now, and consumed is true only when that update changed the row. Before, the route ran the same update but never said whether it was first. Two refreshes with the same token both passed the library's consumed check, both consumed, and both rotated. Now exactly one wins, and the edge treats the other as reuse (fells-code/seamless-auth-oidc-provider, feat/atomic-refresh-consume).
• An expired record is never consumed.

Contract

A response shape change on one /oidc/* route. Only the provider service calls it, and it moves in the same release.

Checks (against types 0.34.0-next.4)

• npm run typecheck, npm run lint, npm run format:check: clean
• npm run test:run: 2731 passed
• TEST_DB=postgres tests/postgres/oidcProvider.spec.ts: 15 passed, including a new test where 8 concurrent consumes of one refresh token produce exactly one true
• Real stack with the edge branch: two concurrent refreshes with one refresh token. Neither rotated. Both got invalid_grant, the session ended as reuse, and the second app was sent to sign in. The edge logged no server error. Before this change, both rotated.