OAuth proxy spike

Tests the oauth.guickly.ai flow: (1) prime a signed gk_tenant cookie, (2) create a Nango connect-session, (3) open Nango's Connect UI. Bitbucket redirects to /api/oauth-callback (via NANGO_CALLBACK_URL), which reads the cookie and forwards to the right tenant's Nango. Watch the log + the Network tab for the callback's cookie.