feat(security): full OAuth 2.1 / OpenID Connect server and OIDC relying-party client

Authorization server: consent and scopes, OIDC (nonce, auth_time, acr, sid,
at_hash, signed userinfo, RP-initiated and back-channel logout), managed
refresh tokens with rotation and reuse detection, RFC 9068 JWT access tokens,
DPoP, PAR, device grant, token exchange, private_key_jwt, RFC 7591/7592
registration, RFC 9207 iss, signing keyring with rotation.

State is DB-backed through a new lookup.OAuthGrantStore (procedure and direct
backends, four dialect DDLs, conformance cases).

Client side: WithOIDC discovery, PKCE, nonce, id_token validation, OAuth2LogoutURL.

PeekRefresh now returns already rotated tokens so RotateRefresh can detect reuse.

Docs: OAUTH2_SERVER.md, oauth2_full_example.go, breaking_changes.md step 8.

pkg/security/lookup/backends/backends.go

@@ -71,6 +71,9 @@ func New(db *sql.DB, cfg lookup.Config, opts Options) (*lookup.Provider, error)
 		OAuthUser: &oauthUserRouter{c: c,
 			proc:   procedure.NewOAuthUsers(run, res.Procs),
 			direct: direct.NewOAuthUsers(base)},
+		OAuthGrant: &oauthGrantRouter{c: c,
+			proc:   procedure.NewOAuthGrants(run, res.Procs),
+			direct: direct.NewOAuthGrants(base)},
 		Passkey: &passkeyRouter{c: c, proc: p, direct: direct.NewPasskey(base)},
 		TOTP: &totpRouter{c: c,
 			proc:   procedure.NewTOTP(run, res.Procs),
@@ -90,6 +93,7 @@ func Failed(err error) *lookup.Provider {
 		Keys:        &keysRouter{c: c},
 		OAuthClient: &oauthClientRouter{c: c},
 		OAuthUser:   &oauthUserRouter{c: c},
+		OAuthGrant:  &oauthGrantRouter{c: c},
 		Passkey:     &passkeyRouter{c: c},
 		TOTP:        &totpRouter{c: c},
 		Policy:      &policyRouter{c: c},