Align OIDC and mobile-approve on a single out-of-band mechanism

The two out-of-band MFA methods use different mechanisms: OIDC is poll-only, mobile-approve is WS-primary with poll fallback.

This is deliberate, not accidental. OIDC's callback arrives as an HTTP redirect into enterprise/grpc/desktop_client_mfa.rs, so there is no oneshot to park - park is inapplicable, not merely unpreferred. Mobile-approve already has an open WebSocket, so parking is the natural fast path.

Converging them would simplify the engine and the #3046 contract.