refactor(open-sse): single-source OAuth token URLs via PROVIDERS (C2)

OAUTH_ENDPOINTS.{openai,anthropic,iflow}.token now reference PROVIDERS.*.tokenUrl
(values identical) so each backend token URL is declared once. qwen left as-is
(its appConstants/PROVIDERS values intentionally differ). Add verify-oauth-urls
script; URLs byte-for-byte equal, gate clean.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/__baseline__/oauth-urls-baseline.json

@@ -0,0 +1,44 @@
+{
+  "oauthEndpoints": {
+    "google": {
+      "token": "https://oauth2.googleapis.com/token",
+      "auth": "https://accounts.google.com/o/oauth2/auth"
+    },
+    "openai": {
+      "token": "https://auth.openai.com/oauth/token",
+      "auth": "https://auth.openai.com/oauth/authorize"
+    },
+    "anthropic": {
+      "token": "https://api.anthropic.com/v1/oauth/token",
+      "auth": "https://api.anthropic.com/v1/oauth/authorize"
+    },
+    "qwen": {
+      "token": "https://qwen.ai/api/v1/oauth2/token",
+      "auth": "https://qwen.ai/api/v1/oauth2/device/code"
+    },
+    "iflow": {
+      "token": "https://iflow.cn/oauth/token",
+      "auth": "https://iflow.cn/oauth"
+    },
+    "github": {
+      "token": "https://github.com/login/oauth/access_token",
+      "auth": "https://github.com/login/oauth/authorize",
+      "deviceCode": "https://github.com/login/device/code"
+    }
+  },
+  "tokenUrls": {
+    "claude": "https://api.anthropic.com/v1/oauth/token",
+    "codex": "https://auth.openai.com/oauth/token",
+    "qwen": "https://chat.qwen.ai/api/v1/oauth2/token",
+    "iflow": "https://iflow.cn/oauth/token",
+    "kiro": "https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken",
+    "xai": "https://auth.x.ai/oauth2/token",
+    "cline": "https://api.cline.bot/api/v1/auth/token",
+    "kimi-coding": "https://auth.kimi.com/api/oauth/token"
+  },
+  "authUrls": {
+    "qwen": "https://chat.qwen.ai/api/v1/oauth2/device/code",
+    "iflow": "https://iflow.cn/oauth",
+    "kiro": "https://prod.us-east-1.auth.desktop.kiro.dev"
+  }
+}