feat: VK OAuth flow, catalog sync improvements, and expanded test suite

- Add VK OAuth implicit flow: /vk-auth redirect, /vk-callback JS page,
  /vk-callback/save endpoint with state validation
- Add VK_CLIENT_ID/VK_CLIENT_SECRET to config
- Add refresh_token/token_expires_at columns to vk_connections (migration 0006)
- Fix vk_catalog task: handle price/thumb_photo as string or dict (VK API v5.199)
- Fix connections/vk/test: use groups.getById instead of market.getAlbums
  (works with both user and group tokens)
- Add orphan deletion to mirror_to_vk: VK products not in Evotor are removed
- Handle ungrouped Evotor products: push to "Без категории" VK album
- Respect SyncConfig.is_enabled in mirror_to_vk
- Add product count column to catalog groups page
- Add group name column to catalog products page
- Expand test suite: 73 new tests covering connections routes, catalog routes,
  vk_sync task logic, and catalog task helpers (138 total, all passing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/templates/catalog/groups.html

@@ -23,6 +23,7 @@
                 <tr>
                     <th>Синхронизация</th>
                     <th>Название</th>
+                    <th>Количество товаров</th>
                     <th>ID</th>
                     <th>Обновлено</th>
                     <th></th>
@@ -47,6 +48,7 @@
                         </form>
                     </td>
                     <td><i class="bi bi-folder2 me-1 text-muted"></i> <strong>{{ g.name }}</strong></td>
+                    <td class="text-muted small">{{ product_counts.get(g.evotor_id, 0) }}</td>
                     <td class="text-muted small">{{ g.evotor_id }}</td>
                     <td class="text-muted small">{{ g.fetched_at | datefmt }}</td>
                     <td>