Start the upstream OAuth authorization for a pending flow

Reconstructs the upstream provider's authorize URL for a pending OAuth flow. The auth-landing page redirects the browser to that URL; the user completes upstream auth; the upstream provider redirects back to /api/oauth/callback, which exchanges the code for tokens server-side and stores them against the flow's identity.

Returns 410 if the flow is no longer pending (expired / completed / failed). The caller should restart the original action to get a fresh flow.