Add one-time exchange code mechanism for native app OIDC login.
Instead of exposing session ID in redirect URL, generates a
short-lived single-use code stored in Redis. Native apps exchange
this code for the session ID via a dedicated API endpoint.
Includes NativeAppRedirect for custom URL schemes, rate limiting,
logging, and whitelist of allowed schemes.
Closes#1153
Co-Authored-By: gigi206