Fix OAuth owner isolation and post-merge reliability failures

[zackbart]

This follow-up to #643 fixes 15 confirmed failures from the post-merge bug sweep. Personal OAuth owners refresh independently, legacy issuer migration preserves token rotation and revocation, and active OAuth work survives registry-cache pressure without duplicate token redemption. Retained views preserve closed call admission and resolve the current owner registry for OAuth work.

The remaining fixes enforce catalog limits after invalidation, apply current artifact quotas to historical snapshots, reject stalled refresh cursors, reconcile failed operator mutations, preserve file snapshots and corruption recovery, and reject malformed named Vercel responses while retaining raw text and valid no-content replies.

Artifact frame metadata now reserves 8 KiB, reducing the content allowance by 4 KiB. Deployment configuration and public Promise APIs are unchanged.

Verification on bf0d487612fc069435d0d6fda5f6da21d8ab2060:

• npm run release:check passed: 4,987 Node/Workers tests, 56 existing skips, 54 Chromium tests, all static/build/declaration/bundle/example gates, zero production audit vulnerabilities, and 189-file package validation with real Docker deployment smoke.
• A fresh independent Sol 6.1 source reviewer reviewed the complete change and final corrections, with no remaining actionable findings.
• A separate fresh Sol 6.1 tester passed 232 affected Node tests, 232 Workers tests and eight probes against rebuilt production modules. Its static/build/package/security checks and real Docker smoke passed on the same head. Chromium launch is restricted in its sandbox; the parent’s full Chromium run supplies that verification.
• GitHub CI passed the full release check on the exact head: https://github.com/zackbart/connecta/actions/runs/36888700453.

Fixes #644
Fixes #645
Fixes #646
Fixes #647
Fixes #648
Fixes #649
Fixes #650
Fixes #651
Fixes #652
Fixes #653
Fixes #654
Fixes #655
Fixes #656
Fixes #657
Fixes #658