## Because
- `fxaccounts:oauth_flow_begin` carries no service in either direction. FxA rebuilds the sign-in URL and hardcodes `service=sync`.
- Every caller today is a Sync flow, so that literal is correct. A future FxA-initiated non-Sync flow would become a Sync sign-in with no error.
- This is hardening, not a bug fix. No current caller changes behaviour.
## This pull request
- Adds an optional `service` argument to `fxaOAuthFlowBegin`. The payload sends it with the scopes, and omits the key when the caller passes none.
- Renames `buildSyncOAuthSearch` to `buildOAuthSearch`. It takes the service from the caller, then the browser echo, then falls back to `sync`.
- Adds `WebChannelService`, derived from the `WebChannelServices` keys. A runtime set rejects an echo that is not one of the four names.
- Passes `sync` explicitly from `Pair/Index` and `ConnectAnotherDevice`, and adds a CAD test that asserts the resulting URL.
- Leaves `useOAuthFlowRecovery` alone. It still preserves the params already in the URL.
## Issue that this pull request solves
Closes: https://mozilla-hub.atlassian.net/browse/FXA-14371