fix(api): /auth/github + /auth/google/callback agent-actionable missing-field copy (BUG-API-184)

[mastermanas805]

Summary

• POST /auth/github body `{}` returned `message: "code field is required"` — accurate but agent-unhelpful. An LLM hitting this 4xx needed to either know the GitHub OAuth code-exchange contract already or open /openapi.json to learn what to send.
• Stamp the full request-body shape inline so the agent can retry without a second round-trip: `Request body is missing the required `code` field. POST `{"code": "<github_oauth_code>"}` ...`
• Per rule 16 (enumerate ALL call sites), the same "code field is required" string lived on /auth/google/callback — mirrored the same upgrade there, plus the adjacent `missing_redirect_uri` message.
• Error codes (`missing_code`, `missing_redirect_uri`) stay stable — agents branching on `.error` are unaffected.

Coverage block

```
Symptom: /auth/github POST nofields 400 message should list required fields (BUG-API-184)
Enumeration: rg -F 'code field is required' internal/ (2 sites pre-fix)
rg -F 'redirect_uri field is required' internal/ (1 site pre-fix)
rg -F 'missing_code' internal/handlers/ (2 emit sites in auth.go)
Sites found: 2 missing_code emits + 1 missing_redirect_uri emit
Sites touched: 3 (rule 16 compliant)
Coverage test: TestAuth_GitHub_MissingCodeAndBadBody asserts:
- .error == "missing_code" (back-compat)
- .message contains `\code\\` (the field name)
- .message contains `{"code":` (the body shape)
so a future regression to the bare message fails before merge.
Live verified: pending auto-deploy +
curl -s -X POST -H 'Content-Type: application/json' -d '{}' \
https://api.instanode.dev/auth/github | jq .message
```

Inbox reference

• BUG-API-184 (P3 — /auth/github POST nofields 400 — message should list required fields)

Test plan

• `go test ./internal/handlers/ -run TestAuth_GitHub` green
• `go vet ./...` clean
• Live verify: response message after auto-deploy contains the new body-shape hint
• Live verify rule 14: `curl https://api.instanode.dev/healthz | jq -r .commit_id` matches merge SHA

🤖 Generated with Claude Code