[MekDrop]

Summary

• Add frontend/src/services/gitlab.js with two exported functions:
  • startGitlabLogin(host, clientId) — generates a 48-byte hex code_verifier, derives code_challenge via crypto.subtle.digest('SHA-256') + base64url, stores verifier + host in sessionStorage, redirects to GitLab authorize endpoint with full PKCE params
  • exchangeGitlabCode(code) — reads and removes verifier/host from sessionStorage, POSTs application/x-www-form-urlencoded to /oauth/token, returns parsed JSON response
• Supports both gitlab.com and self-hosted GitLab instances

Test plan

• startGitlabLogin('gitlab.com', clientId) redirects to https://gitlab.com/oauth/authorize with response_type=code, scope=read_api, code_challenge_method=S256, correct redirect_uri
• sessionStorage keys gitlab_verifier and gitlab_host are set before redirect
• exchangeGitlabCode(code) POSTs to https://gitlab.com/oauth/token with correct body fields
• sessionStorage keys are removed after exchangeGitlabCode is called
• Works with a custom self-hosted GitLab host URL

Closes #7