feat(security): full OAuth 2.1 / OpenID Connect server and OIDC relying-party client

Authorization server: consent and scopes, OIDC (nonce, auth_time, acr, sid,
at_hash, signed userinfo, RP-initiated and back-channel logout), managed
refresh tokens with rotation and reuse detection, RFC 9068 JWT access tokens,
DPoP, PAR, device grant, token exchange, private_key_jwt, RFC 7591/7592
registration, RFC 9207 iss, signing keyring with rotation.

State is DB-backed through a new lookup.OAuthGrantStore (procedure and direct
backends, four dialect DDLs, conformance cases).

Client side: WithOIDC discovery, PKCE, nonce, id_token validation, OAuth2LogoutURL.

PeekRefresh now returns already rotated tokens so RotateRefresh can detect reuse.

Docs: OAUTH2_SERVER.md, oauth2_full_example.go, breaking_changes.md step 8.

pkg/security/lookup/backends/conformance_test.go

@@ -113,6 +113,11 @@ func cleanup(t *testing.T, db *sql.DB, d dialect.Dialect, prefix string) {
 	like := prefix + "%"
 	for _, q := range []struct{ table, col string }{
 		{"oauth_codes", "code"},
+		{"oauth_consents", "client_id"},
+		{"oauth_refresh_tokens", "client_id"},
+		{"oauth_device_codes", "client_id"},
+		{"oauth_par_requests", "client_id"},
+		{"oauth_jti", "jti_key"},
 		{"oauth_clients", "client_id"},
 		{"token_blacklist", "token"},
 		{"sec_column_rules", "schema_name"},