Core prerequisites for bibb-community Playwright refactor

Additive features (no breaking changes to existing consumers):

- mail/        MailClient interface + MailpitClient default impl + DDEV
               URL helper (deriveMailpitApiBase). Subpath export ./mail.
               TLS-bypass for self-signed DDEV certs via undici.Agent +
               undici.fetch (Node 22 compatible).
- auth/        DrupalOAuthIdpFlow — Drupal-side OAuth IdP choreography
               helper (login + consent + waitForURL).
- themes/      openSocialFrontendConfig — login form selector override
               (#edit-name-or-mail) for Open Social distribution.
- visual-compare/ VISUAL_DIAGNOSTICS reporter contract — typed
               annotations on diff/404 outcomes (no regex on error msgs).

Fixtures: mailpit (MailClient), drupalOAuthIdp (DrupalOAuthIdpFlow),
         typed CoreTestOptions (mailpitApiBase, mailpitIgnoreTlsErrors).

Documentation: src/auth/README.md, src/mail/README.md (new),
              src/visual-compare/README.md, src/README.md,
              src/fixtures/README.md, monorepo-root README.md.

Integration tests against DDEV simple_oauth + bundled Mailpit:
- oauth-idp-flow.spec.ts (skip-consent path)
- oauth-idp-flow-auto-grant.spec.ts (third_party=TRUE consumer)
- oauth-idp-flow-token-exchange.spec.ts (E2E code → access+refresh token)
- mail-password-reset.spec.ts (Drupal mail → Mailpit → extract link)

All four specs run parallel-safe.