Refactored to maintain a separate cloud version

Moves 12 packages from internal/ to pkg/ (config, id, validate, events, db,
auth, lifecycle, scheduler, channels, audit, service) so they can be imported
by the enterprise repo as a Go module dependency.

Introduces pkg/cpextension (shared Extension interface + ServerContext) and
pkg/cpserver (Run() entrypoint with functional options) so the enterprise
main.go can call cpserver.Run(cpserver.WithExtensions(...)) without duplicating
the 20-step server bootstrap. Adds db/migrations/embed.go for go:embed access
to OSS SQL migrations from the enterprise module.

cmd/control-plane/main.go is reduced to a 10-line wrapper around cpserver.Run.

pkg/db/oauth.sql.go

@@ -0,0 +1,57 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+// source: oauth.sql
+
+package db
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const getOAuthProvider = `-- name: GetOAuthProvider :one
+SELECT provider, provider_id, user_id, email, created_at FROM oauth_providers
+WHERE provider = $1 AND provider_id = $2
+`
+
+type GetOAuthProviderParams struct {
+	Provider   string `json:"provider"`
+	ProviderID string `json:"provider_id"`
+}
+
+func (q *Queries) GetOAuthProvider(ctx context.Context, arg GetOAuthProviderParams) (OauthProvider, error) {
+	row := q.db.QueryRow(ctx, getOAuthProvider, arg.Provider, arg.ProviderID)
+	var i OauthProvider
+	err := row.Scan(
+		&i.Provider,
+		&i.ProviderID,
+		&i.UserID,
+		&i.Email,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const insertOAuthProvider = `-- name: InsertOAuthProvider :exec
+INSERT INTO oauth_providers (provider, provider_id, user_id, email)
+VALUES ($1, $2, $3, $4)
+`
+
+type InsertOAuthProviderParams struct {
+	Provider   string      `json:"provider"`
+	ProviderID string      `json:"provider_id"`
+	UserID     pgtype.UUID `json:"user_id"`
+	Email      string      `json:"email"`
+}
+
+func (q *Queries) InsertOAuthProvider(ctx context.Context, arg InsertOAuthProviderParams) error {
+	_, err := q.db.Exec(ctx, insertOAuthProvider,
+		arg.Provider,
+		arg.ProviderID,
+		arg.UserID,
+		arg.Email,
+	)
+	return err
+}