Spike: Meta as OAuth2 plus Graph profile, and the data deletion callback

[ParallelEntrepreneur]

Part of #1.

Blocked by: none. Blocks both Meta issues.

Problem. Facebook Login is OAuth 2.0 without OpenID Connect: there is no ID token, no discovery document, and the profile comes from a Graph API call. The openidconnect crate will not fit. Meta app review also requires a data deletion callback before the app can leave development mode.

Proposed approach.

• Use the oauth2 crate (which openidconnect is built on) for the authorization-code exchange against https://www.facebook.com/v19.0/dialog/oauth and https://graph.facebook.com/v19.0/oauth/access_token, through the harness HttpClient port.
• Profile step: GET https://graph.facebook.com/me?fields=id,name,email with the access token; email may be absent when the user has not verified one or declined the permission. Treat email as optional.
• Verify the token belongs to our app with debug_token or by relying on the direct exchange; decide which.
• Data deletion callback: Meta POSTs a signed_request (base64url payload plus HMAC-SHA256 with the app secret) with the user id; the endpoint must verify it, enqueue deletion, and respond with { url, confirmation_code } where url is a status page. Decide what "deletion" means here: unlink the Meta identity, and delete the user only if it has no other identity and no other data, otherwise anonymise the Meta identity.
• Record what the app review submission needs from us: privacy policy URL, data deletion URL, the email and public_profile permissions.

Acceptance criteria

• A scratch flow completing Facebook Login with a test app in wrangler dev
• Written decision: oauth2 crate plus hand-rolled profile step, with the exact endpoints and fields
• Written decision on what the deletion callback deletes and the confirmation flow
• A signed_request verifier with a test vector
• ADR recorded

[ParallelEntrepreneur]

Answered by ADR 0104, merged in #39 (e25fd81).

Every question this spike asked is decided and written down:

• oauth2 plus a hand-rolled profile step, with the exact endpoints built from one configured Graph version (AUTH_META_GRAPH_VERSION, default v21.0). Configurable rather than compiled in because Meta retires a version roughly two years after release and an expired one starts answering errors.
• Email is optional and never verified. Stronger than "treat as optional": email_verified is hard-coded false. An address recorded as verified is a key — the linking rules auto-link on a verified match — so believing Meta would mean anyone who can get an address onto a Facebook account walks into the matching account here.
• No debug_token. The token arrived on a back-channel response to a request this service made, authenticated with the app secret, so it is by construction ours. The confused-deputy problem debug_token exists for is real for a client-side token, which this service never accepts — recorded explicitly so a future path that does accept one does not inherit the reasoning by accident.
• The deletion callback, including what "deletion" means: unlink the Meta identity, and delete the account entirely only when no other identity and no other credential remains.
• A signed_request verifier with test vectors — crates/auth-meta/src/signed_request.rs, nine tests including a signature over the decoded bytes rather than the base64 text (the mistake that fails every request and looks like a wrong secret), a correctly-signed payload nominating alg: none, and a tampered payload keeping a valid signature.
• ADR recorded — 0104.

What this spike listed and did not deliver: the scratch flow against a real Facebook test app. No Meta app, app secret or test user exists on this machine. That criterion is consolidated into #17 rather than left implied here.

App review needs, recorded for whoever submits: privacy policy URL, the data deletion URL (<origin>/v1/auth-meta/data-deletion), and the email and public_profile permissions. The email one is the permission a person can decline, and declining it still signs them in.