feat(workspace): expose typed result from OIDC discovery

Replace the nullable return with a sealed Result type (Discovered,
NotConfigured, Failed) so callers can handle each case explicitly,
including when OIDC is a prerequisite for the account setup flow.