fix(auth): validate OAuth expiry conversions

[tiankaima-copilot]

Summary

• parse OAuth expires_in values within the native integer width
• reject non-positive, fractional, integer-overflow, and time.Duration-overflow values
• use the existing fallback expiry when a provider returns an unsafe value
• add regression coverage for numeric/string encodings and overflow boundaries

Validation

• make test
• make lint
• make vet
• git diff --check

Resolves CodeQL alerts #1 and #2 (go/incorrect-integer-conversion).