Move browser authentication presentation into Admin

[adrianwebb]

Keep OAuth, account, team, token, permission, and audit custody in API while replacing placeholder HTML with validated Admin presentation contracts and preserving the catalogued protocol guarantees.

[adrianwebb]

Implementation is now in draft PR #96. API build and OAuth security tests pass; browser HTML placeholders are removed and Admin owns presentation.