fix: bug sweep — timetable envelopes, session cleanup, oauth device flow

[nycomp]

Self-contained bug sweep verified against campus weekly (74738e1). No API redesign, no model changes, no impact on other services (campus-cli has its own device-flow implementation and does not import campus_python.auth.v1.oauth).

Bugs fixed

api (timetable) — closes #54

• Timetables.list() unwraps the {"data": [...]} envelope; previously iterated the envelope dict and crashed with TypeError: string indices must be integers.
• Timetables.new() unwraps the {"data": <resource>} create envelope (route returns 200 + envelope, not 201).
• Timetable.get() unwraps the {"timetable": <resource>} envelope and parses into campus.model.Timetable; previously returned the raw envelope while declaring campus.model.Timetable.
• Timetable.Metadata.get() parses TimetableMetadata (was Timetable.from_resource against its declared return type).
• Timetable.Metadata.update() implemented — the route is live server-side and requires start_date + end_date together; was a NotImplementedError stub.

auth — closes #59

• CampusSessions._session_key now yields campus_session_id; path.split("/")[-1] on "sessions/campus/" produced "", storing login state under the generic _session_id key (server provider convention: f"{PROVIDER}_session_id", campus/auth/provider.py:62).
• Session.finalize() / Login.revoke() clear the Flask key with pop(key, None) — a missing key (expired cookie, worker restart, lost session) no longer turns an already-successful remote op into a 500 KeyError.
• OAuth device flow posts the real /auth/v1/oauth/device_authorize, /auth/v1/oauth/token, /auth/v1/oauth/device/authorize routes; the old absolute /oauth/... paths missed the /auth/v1 prefix and 404 (auth app sets strict_slashes = True).
• poll_for_token() maps RFC 8628 error responses to AuthenticationError(details={"oauth_error": ...}) — readable via the existing APIError.oauth_error property. The old call passed error_code=, which is not an APIError.__init__ parameter, so the intended error type raised TypeError instead.
• ClientAccess.get() requests /access/ with its trailing slash (rule /<client_id>/access/ + strict_slashes; the slash-less path 404'd on real deployments).
• Auth.finalize() step 4 ("Ensure user exists") actually calls .get() now — it previously constructed the resource object as a no-op. Safe: the server provisions the user during verify_login before the callback.
• LoginSessions.new() parses the create response once instead of twice.

Tests

• New: test_timetable.py (envelopes + metadata update), test_oauth_device_flow.py (paths + RFC 8628 error mapping), test_sessions.py (campus_session_id key, finalize/revoke without session key), test_token_refresh.py (refreshed token is returned, not the stale one).
• Updated: test_auth_clients.py (access trailing slash), test_nested_resources.py (metadata-get pins TimetableMetadata).

146 passed (was 124).

Also fixed in passing

Campus._get_token_from_session now returns the refreshed token — the refresh-token grant rotates server-side, but the method handed back the stale user_creds.token it had just replaced.

Not in scope (filed separately / existing issues)

• perf(auth): push_context makes 1-2 auth API calls on every request — cache or lazy-resolve the request user #57 (per-request auth calls) — perf work, needs a caching design.
• Add client.integrations.list() for the integrations registry #56, feat: add configurable JsonClient class for dependency injection #19, Route trailing slash compliance: Add trailing slashes to subresource ID paths #13, Add Timetable resource #2 — feature/sync gaps; delta report to follow.