A failed OAuth connect or callback renders an operator page, not JSON

[czpython]

GET /api/oauth/{slug}/connect and GET /api/oauth/callback are reached by full-page browser navigation — the Settings card opens the connect door in a new tab, and the provider redirects the callback back to it. On success the callback already renders an HTML page. On failure both doors raised HTTPException, so the operator landed on raw JSON.

Both doors now raise a typed OauthPageError that carries its status. One handler renders it as an operator page in the same chrome as the success page: the message names the fix — an unset urls.endpoint, client credentials that are not connected yet, a denied consent — and the real status code is kept. The JSON API routes on the same router are unchanged, so a fetch still gets the JSON envelope.

The scope is kept small. When the flow carries a next, a bounce back to it with an ?oauth_error query is left out until a caller navigates the connect door with next; nothing does today.