[2.x] feat(core): redirect-only OAuth flow — rewrite ResponseFactory

[imorland]

Summary

This PR is one half of a two-part OAuth overhaul. The companion PR is FriendsOfFlarum/oauth#109 — both must be merged together.

Docs will follow shortly after review.

Changes

• ResponseFactory::make() now accepts a $returnTo string and returns a RedirectResponse in all cases. Logged-in users are redirected with a remember-me cookie; new users are redirected with _flarum_auth=<token> appended so the frontend can open SignUpModal.
• ResponseFactory stores suggested fields (username, email) in the RegistrationToken payload under a suggested key so they survive the redirect and can be returned to the frontend.
• ResponseFactory::makeLoggedInResponse() and makeRegistrationResponse() are now protected — extensions can subclass and override either method to customise the login redirect or registration handoff. _flarum_linked URL-building is handled in make() before the call, keeping both method signatures clean and stable.
• _flarum_linked={provider} param — appended to the redirect URL when a user's account is linked to an OAuth provider for the first time (email-match auto-link path). The companion fof/oauth PR does the same for the manual security-page link flow. The frontend detects the param and shows an AccountLinkedModal.
• POST /api/registration-token — new endpoint (ResolveRegistrationTokenController) that accepts a token in the POST body and returns only username, email, and provided[]. Provider name, identifier, and payload internals are never exposed. Token in POST body keeps it out of server access logs, browser history, and Referer headers.
• registration-token added to CSRF exempt paths — unauthenticated POST is allowed since token possession is the credential.
• ForumApplication::authenticationComplete() removed — it existed solely for the popup JS callback path.
• SignUpModal field labels — Username, Email, and Password fields now show a visible <label> above the input. Nicknames extension's Nickname field updated the same way. Fixes the OAuth pre-fill UX where placeholder text disappears once a value is present, making Username and Nickname look identical.
• Unit and integration test coverage added for Registration, ResponseFactory, LoginProvider, and ResolveRegistrationTokenController.

---

⚠️ Breaking Changes

What changed	Migration
ResponseFactory::make() signature adds a required string $returnTo fourth argument	Pass the validated same-origin returnTo URL; defaults to '/'
ResponseFactory::make() returns RedirectResponse instead of HtmlResponse	Controllers that rendered the old HTML/JS response must be updated
ForumApplication::authenticationComplete() removed	Remove any calls to this method; the frontend now reads _flarum_auth from the URL on boot

Any extension with a custom OAuth controller that calls ResponseFactory::make() directly must be updated.

Test plan

• New user OAuth signup redirects to returnTo with _flarum_auth param, SignUpModal opens pre-populated with username/email
• Existing user OAuth login redirects to returnTo with remember cookie and no _flarum_linked param
• Email-match auto-link redirects with _flarum_linked={provider}, AccountLinkedModal appears
• POST /api/registration-token returns username/email/provided for valid token
• POST /api/registration-token returns 404 for invalid/expired/missing token
• Provider name, identifier, and payload internals not present in token resolution response
• SignUpModal shows labels for all fields; Username and Nickname are clearly distinguishable when both pre-filled
• Unit tests pass: php vendor/bin/phpunit framework/core/tests/unit/Forum
• Integration tests pass: php vendor/bin/phpunit framework/core/tests/integration/forum/Auth
• Token resolution tests pass: php vendor/bin/phpunit framework/core/tests/integration/api/registration_tokens

[imorland]

Companion PR: FriendsOfFlarum/oauth#109 — both must be merged together.