feat: VK OAuth flow, catalog sync improvements, and expanded test suite

- Add VK OAuth implicit flow: /vk-auth redirect, /vk-callback JS page,
  /vk-callback/save endpoint with state validation
- Add VK_CLIENT_ID/VK_CLIENT_SECRET to config
- Add refresh_token/token_expires_at columns to vk_connections (migration 0006)
- Fix vk_catalog task: handle price/thumb_photo as string or dict (VK API v5.199)
- Fix connections/vk/test: use groups.getById instead of market.getAlbums
  (works with both user and group tokens)
- Add orphan deletion to mirror_to_vk: VK products not in Evotor are removed
- Handle ungrouped Evotor products: push to "Без категории" VK album
- Respect SyncConfig.is_enabled in mirror_to_vk
- Add product count column to catalog groups page
- Add group name column to catalog products page
- Expand test suite: 73 new tests covering connections routes, catalog routes,
  vk_sync task logic, and catalog task helpers (138 total, all passing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/templates/connections.html

@@ -134,14 +134,15 @@
             {% endif %}
 
             <div class="card-body">
-                <details {% if not vk %}open{% endif %}>
-                    <summary>
-                        {% if vk %}Обновить подключение{% else %}Подключить ВКонтакте{% endif %}
-                    </summary>
-                    <p class="text-muted small mt-2">
-                        Укажите токен пользователя VK с правами <code>market,photos,groups</code>
-                        и ID сообщества, в котором включён Маркет.
-                    </p>
+                <div class="mt-3">
+                    <a href="/vk-auth" role="button">
+                        <i class="bi bi-box-arrow-in-right me-1"></i>
+                        {% if vk %}Переподключить ВКонтакте{% else %}Войти через ВКонтакте{% endif %}
+                    </a>
+                </div>
+
+                <details class="mt-3">
+                    <summary class="text-muted small">Ввести токен вручную</summary>
                     <form method="post" action="/connections/vk" class="mt-2">
                         <label>
                             Токен доступа VK