fix(oauth): reject malformed nonce metadata

[tang-vu]

Why this matters

OAuth nonces are JSON files at the boundary between the authenticated init call and the public provider callback. Syntactically valid JSON with a non-numeric created_at or ttl_seconds bypassed the existing corrupt-file handler, raised during integer conversion, and could make every new OAuth init fail or turn a provider callback into a 500.

Root cause and invariant

Metadata conversion happened outside the narrow read/parse exception boundary in both nonce pruning and callback validation. The invariant is that malformed persisted nonce metadata is rejected and removed like malformed JSON; it must never issue a state, write a callback code, or crash the public flow.

Integer conversion now occurs inside the existing I/O validation blocks with specific type/value/overflow exceptions.

Overlap check

Searched open and closed PRs for oauth nonce malformed metadata, nonce prune invalid ttl, and the changed router/test files. No semantic match or open same-file PR was found. Existing OAuth tests covered invalid JSON and expiry, but not valid JSON with invalid metadata types.

Regression coverage

Two authenticated init-boundary cases plant invalid timestamp/TTL types and prove a fresh nonce is still issued while the corrupt file is pruned. A public callback-boundary test corrupts a live nonce's TTL type, asserts 400, and proves both the nonce and callback side effects are absent.

Validation

• pytest -q ods/extensions/services/dashboard-api/tests/test_oauth_passthrough.py -x ? 49 passed, 2 skipped
• python -m py_compile ods/extensions/services/dashboard-api/routers/oauth_passthrough.py ods/extensions/services/dashboard-api/tests/test_oauth_passthrough.py
• git diff --check

Tradeoffs and rollback

Malformed nonce files are single-use temporary state and are deleted, matching the existing invalid-JSON policy. Valid flows are unchanged. Revert restores the two uncaught conversion paths; no persistent schema migration is involved.

[tang-vu]

Batch compatibility receipt (2026-08-23)

Validated merge order: #2989 ? #2990 ? #2993 ? #2991 ? #2992 ? #2994 ? #2995 ? #2996 ? #2997 ? #2998. The changes are independently useful; this order only reconciles shared model-router and magic-link files.

Synthetic integration head: origin/batch/quality-ten-20260822-round2-integration at 91eb730d. The only textual conflict was the two model-router tests inserting at the same class boundary; the integration resolution retains both contracts. Magic-link changes merged cleanly.

Combined validation on that exact head:

• remote-provider egress contract: 16 passed
• Token Spy suites: 22 passed, 1 skipped (live PostgreSQL availability)
• model-router suite: 55 passed
• APE suite: 29 passed
• dashboard OAuth + magic-link suites: 118 passed, 2 platform skips
• Brave Search loopback E2E: all checks passed
• git diff --check: passed

All required GitHub checks are green across the batch. #2992 initially hit a transient openSUSE repository/mirror failure while installing rsync; a clearly labeled empty retry commit reran the unchanged tree, and openSUSE plus the full matrix passed.