Adds ZitadelAppType::Web (authorization-code + PKCE public client, devMode, redirect URIs) and ZitadelHumanUser (password + verified email + project role grants), so an interactive browser login can be provisioned for tests/seeding. The existing device-code app and machine-user paths are untouched (additive).