Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/coredata/migrations/20260717T121103Z.sql

@@ -17,5 +17,5 @@
 
 UPDATE trust_centers
 SET
-    slug = slug || '-' || encode(gen_random_bytes(4), 'hex'),
+    slug = slug || '-' || encode(gen_random_bytes(16), 'hex'),
     updated_at = clock_timestamp();