feat(oauth): add an untrusted-client consent screen and restore 321done

[vbudhram]

Because

• 321done could not complete a sign-in: the shared secrets file overrode the per-instance config, so the untrusted app sent the wrong client secret.
• An untrusted client's sign-in redirected straight back to the relying party, telling the user nothing about the profile information it reads.
• No functional test drove the untrusted client, so both gaps were invisible.

This pull request

• Loads the per-instance 123done config after the shared secrets file, so each client resolves its own secret.
• Adds a React consent screen at /signin_permissions that lists the email and display name an untrusted client can read.
• Gates the screen on a new isUntrusted(), so an unresolved client lookup never treats a trusted client as untrusted.
• Returns a consent_required error instead of the screen when the relying party sent prompt=none.
• Badges the untrusted demo app and reports the flag on /api/auth_status.
• Adds the untrusted port to clean-start and lets the pm2 readiness banner report two apps for one project.
• Adds untrusted relier and permissions page objects, seven Playwright tests, and unit tests for the scope and consent rules.

Issue that this pull request solves

Closes: FXA-14505

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: packages/fxa-settings/src/pages/Permissions/, src/lib/oauth/permissions.ts, and the gate in src/pages/Signin/utils.ts.
• Suggested review order: the consent rules in permissions.ts, then the gate, then the screen and its container.
• Risky or complex parts: the gate runs for untrusted clients only, so a trusted client keeps its key material and never routes through a page.

Screenshots (Optional)

The consent screen an untrusted client now shows:

Recording, sign-in at 321done through the consent screen and back to the relying party:

video.mp4

Other information (Optional)

FXA-14505 lists the consent screen as out of scope. This pull request adds one. The Jira comment on the ticket records that change and the earlier FXA-8827 decision it reverses.