No Merge Require - support prompt in authorize

[KevyVo]

There is not prompt field in the AuthorizationState by allowing this we are able to do the following.

The openauth package doesn't forward the prompt parameter from our app to GitHub. So when we tell it "hey, ask the user for consent again," it just ignores us and does a normal login.

We need two small plumbing changes inside openauth to pass prompt through:

1. issuer.ts — when our app sends /authorize?prompt=consent, the issuer needs to read it and forward it to the provider's
   internal /github/authorize?prompt=consent route
2. oauth2.ts — the provider needs to read it and put it on the actual GitHub URL:
   https://github.com/login/oauth/authorize?...&prompt=consent

Without both, the prompt=consent gets dropped along the way and GitHub never sees it.

This PR will solve this. There was PR in portal related to this: https://github.com/DefangLabs/portal/pull/484.

There no need to merge this PR unless we want to sync the Git subtree.

[defangdevs]

Finding from the portal↔openauth reconciliation (PR #9): this feature is already live in portal — portal PR 484 ("Enable current users to grant Github orgs to Defang", merged 2026-02-10) contains the identical prompt support in issuer.ts + oauth2.ts, and PR #9 carries it into defang (with prompt?: string rather than this branch's prompts?: string, and alongside the scopes support this branch predates).

I rebased this branch onto the reconciliation branch to check: the feature commit collapses to empty (already upstream); the only survivor is a 2-line prettier fix in ui/password.tsx, pushed to defangdevs/openauth:kevin-prompt-rebased.

Suggestion: once PR #9 lands in defang, this PR can be closed (or retargeted to defang for just the formatting fix).

[defangdevs]

The prompt feature already landed in portal via portal PR 484; the surviving 2-line prettier fix is included in https://github.com/DefangLabs/portal/pull/947. The subtree at portal/auth/openauth is now the source of truth and this repo is being archived — nothing further to port from this PR.