chore(oidc): consolidate test OIDCConfig helper + fix exceptions banner (cumulative q-4, q-5)

q-4: tests/test_oidc.py's _make_config and tests/test_oidc_handlers.py's
_make_oidc_config built the same OIDCConfig with sensible defaults but
had drifted — only the handlers helper set redirect_base. After b3
made redirect_base operationally required, every test_oidc.py test
that exercised redirect_base had to override it explicitly. A future
test could omit redirect_base and silently exercise the wrong
production path.

Moves make_oidc_test_config to tests/conftest.py with the more
complete handler-version defaults (including redirect_base). Both
test files import it under their existing local alias
(_make_config / _make_oidc_config) so the 60+ call sites in
test_oidc.py and the handler tests don't have to change.

q-5: section banner '# Exception' (singular) at oidc.py:79 became
inconsistent after b5 (callback robustness) added OIDCKeyNotFoundError.
Renamed to '# Exceptions'.

tests/test_oidc.py

@@ -15,8 +15,8 @@ import httpx
 import jwt as pyjwt
 import pytest
 
+from tests.conftest import make_oidc_test_config as _make_config
 from turnstone.core.oidc import (
-    OIDCConfig,
     OIDCError,
     OIDCKeyNotFoundError,
     _ensure_default_role,
@@ -39,27 +39,6 @@ from turnstone.core.oidc import (
 # ---------------------------------------------------------------------------
 
 
-def _make_config(**overrides) -> OIDCConfig:
-    """Build a test OIDCConfig with sensible defaults."""
-    defaults = {
-        "enabled": True,
-        "issuer": "https://idp.example.com",
-        "client_id": "my-client",
-        "client_secret": "my-secret",
-        "scopes": "openid email profile",
-        "provider_name": "TestIDP",
-        "role_claim": "",
-        "role_map": {},
-        "password_enabled": True,
-        "authorization_endpoint": "https://idp.example.com/authorize",
-        "token_endpoint": "https://idp.example.com/token",
-        "userinfo_endpoint": "https://idp.example.com/userinfo",
-        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
-    }
-    defaults.update(overrides)
-    return OIDCConfig(**defaults)
-
-
 def _mock_storage(**overrides):
     """Build a MagicMock with sensible storage defaults."""
     s = MagicMock()