fix(#533): harden OAuth recovery E2E readiness

[BorisTyshkevich]

What & why

Closes #533.

Prevent OAuth document-recovery E2E runs from accepting an incompatible stale
harness server by probing the fixture's server-only config route instead of a
generic static page.

The fixture readiness latch now also:

• waits for the complete schema, reference, and version loader promises, not
  only the version fetch;
• requires the exact version response to be successful;
• exposes and asserts the drained startup-catalog state before the deliberate
  first-contact 401.

This prevents late startup successes from racing the auth-loss scenario under
full-suite load.

Verification

• npm test
• npm run build
• focused Chromium OAuth recovery spec repeated five times: 15 passed
• full Chromium + WebKit E2E suite: 350 passed, 4 intentionally skipped

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• No new runtime dependency (or it's a deliberate, justified addition — see CONTRIBUTING)
• README / CHANGELOG.md ([Unreleased]) updated if behavior or the deployed surface changed
• Reconciled affected tracked work (roadmap Roadmap to 1.0.0 #68, the issue body, ADR/CHANGELOG) if this change reshaped it