fix(credentials): bind OAuth reconnect drafts to exact flows

Summary

OAuth reconnect drafts are selected by broad ambient context rather than one exact protected flow. Tighten the shared credential-draft lifecycle so concurrent and cross-provider OAuth flows cannot consume or mutate the wrong draft.

Required changes

• validate reconnect target credential type, provider, workspace, and provider-specific environment at draft creation
• return the draft ID and bind it into protected OAuth state
• process the exact draft row identified by that protected state during callback
• repeat type, provider, workspace, and environment checks before the final credential mutation
• preserve ordinary new-credential and legacy OAuth behavior where the same invariants hold

Tests

• concurrent OAuth tabs in one workspace
• concurrent OAuth flows across workspaces
• cross-provider reconnect attempts
• wrong credential type and wrong target credential
• provider-specific environment mismatch
• exact-flow success and replay/expired-draft rejection

Context

This is a platform-wide credential integrity change affecting generic OAuth and custom OAuth flows. It is intentionally separate from Dynamics 365 CRM PR #6714, which adds UI-level environment binding but must not absorb shared draft infrastructure changes.