fix: resolve all 13 remaining test failures

- OAuth: add userId to oauth_codes schema and migration, derive userId
  from stored auth code/token record instead of passing separately
- Auth middleware tests: destructure {db, userId} from createTestDb,
  pass userId to createApiKey, fix error message assertion
- MCP tests: add missing await on getCollectionSummary and
  createSecondTestUser calls

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/oauth.ts

@@ -202,9 +202,14 @@ oauthRoutes.post("/authorize", async (c) => {
 		return c.json({ error: "redirect_uri not allowed" }, 400);
 	}
 
+	// Get or create user from OIDC session
+	const { getOrCreateUser } = await import("../services/auth.service");
+	const user = await getOrCreateUser(db, auth.sub);
+
 	const { code } = await createAuthorizationCode(
 		db,
 		clientId,
+		user.id,
 		codeChallenge,
 		codeChallengeMethod,
 		redirectUri,