[P2] Add end-to-end coverage of forwarding and successful token exchange and refresh #56

Recorded during review of main at a1eb305ccfa2f3fc8ddede4875765cf1b099bd2b. This issue records a finding only; no implementation changes were made or requested.

Finding

Coverage is strongest around helpers and browser handoff security. No end-to-end tests exercise the complete forwarding handler or successful provider token exchange/refresh. The HTTP fixture test exercises upstream_request, not the full authenticated forwarding flow.

Review verification: all 64 default tests and six network-backed pinned-catalog tests passed; formatting and Clippy passed. Three PostgreSQL tests were not run locally; CI is configured to run them with --include-ignored. The first default test run encountered sandbox denial when binding localhost; rerunning with localhost access passed. No numeric line/branch coverage percentage was measured.

Missing cases include traversal, redirects, oversized/slow responses, refresh-token rotation, credential consumption on failures, and database recovery.

Evidence

• src/proxy.rs:244
• src/proxy.rs:276
• src/proxy.rs:495
• src/oauth.rs:156
• .github/workflows/ci.yml:1

Desired outcome

Use local provider fixtures and an isolated PostgreSQL instance to exercise complete success and failure paths, including one-use credential rotation. Keep tests independent of live user credentials.