#540 [API/Perf] oauth2.py blocking requests library in async handler

File: api/oauth_handlers/oauth2.py:374-401. Uses synchronous requests.post() and requests.get() in async oauth2_callback. This blocks the event loop for up to 10s per OAuth login. IMPACT: Degrades API responsiveness under load. FIX: Use httpx async client or asyncio.to_thread().