feat(extension): add Twitter setup wizard backend

[xiaoland]

What changed

• add deployment-wide extensions.state and advance the database runtime contract to v3
• expose typed Extension Host config/state operations without leaking the persistence model to Extensions
• add lifecycle-bound exact public callback routes for provider callbacks
• implement Twitter's OAuth App, PKCE authorization, account transaction, reconnect, Bookmark Source, and initial collection setup flow
• advance the Core Host SDK to 0.1.1 and the Twitter Python Distribution to 0.2.0

Why

Installing and enabling an Extension does not make it operational. Twitter needs a deployment-wide setup flow that survives Web/Core restarts, supports multiple Core Peers, keeps OAuth transaction data separate from user configuration, and delegates Source/job concurrency to Core/PostgreSQL.

The public provider callback is hosted by the running Core Extension and is independent of the browser origin. The Web UI observes only an authenticated, opaque transaction projection.

Impact and boundaries

• migration head becomes c7d8e9f0a1b2; the canonical extensions row gains additive state JSONB
• database contract revision becomes peer-database-runtime-v3
• non-empty Extension state blocks a version change until a future explicit state-migration contract exists
• OAuth credentials remain inside the accepted extensions.config boundary; account, token, and transaction state live in extensions.state
• uninstall still removes the Extension row without inspecting or deleting Sources
• no Registry publication, production deployment, or real-X black-box acceptance is included

Rollback is a code revert plus the repository's normal migration procedure. The schema change is additive, but a deployment that has begun relying on non-empty state must not downgrade blindly without preserving that state.

Verification

• PDM_IGNORE_ACTIVE_VENV=1 uv tool run --from pdm==2.27.0 pdm run check
  • migration suites: 31 + 23 passed
  • format, lint, and type checks passed with 0 diagnostics
  • 241 tests passed
• all six first-party wheel build/entry-point/lifecycle probes remain green
• git diff --check

The dependent Client PR will consume this exact v3 contract and remains merge-blocked until this PR is admitted.

[xiaoland]

Temporarily closing during preview-controller cutover to release the finite review-app/database slot. This PR will be reopened and synchronized immediately after the controller PR lands.

[xiaoland]

Preview-controller cutover is complete. Reopening on the synchronized branch so the new Core + PostgREST review topology can be provisioned.

[xiaoland]

已由 #65 取代；后续 review 与验收请在 #65 继续。