Split MicroZen.OAuth2 into MicroZen.Core + per-provider packages #69

Today all provider code ships in a single MicroZen.OAuth2 package (tracked tech debt). Target:

• MicroZen.Core — shared provider-independent code (state, config, authority gRPC client, grant-type defs, JWT plumbing).
• MicroZen.Auth.<Provider> — one package per provider (Cognito, Supabase, Entra, Auth0, Google).

Done when: core is extracted, Cognito is moved to MicroZen.Auth.Cognito, and consumers import only the provider they need. This is the prerequisite for the provider rollout issues.

See steering .kiro/steering/ecosystem.md (documented in PR #62). section 3.