feat(security): full OAuth 2.1 / OpenID Connect server and OIDC relying-party client

Authorization server: consent and scopes, OIDC (nonce, auth_time, acr, sid,
at_hash, signed userinfo, RP-initiated and back-channel logout), managed
refresh tokens with rotation and reuse detection, RFC 9068 JWT access tokens,
DPoP, PAR, device grant, token exchange, private_key_jwt, RFC 7591/7592
registration, RFC 9207 iss, signing keyring with rotation.

State is DB-backed through a new lookup.OAuthGrantStore (procedure and direct
backends, four dialect DDLs, conformance cases).

Client side: WithOIDC discovery, PKCE, nonce, id_token validation, OAuth2LogoutURL.

PeekRefresh now returns already rotated tokens so RotateRefresh can detect reuse.

Docs: OAUTH2_SERVER.md, oauth2_full_example.go, breaking_changes.md step 8.

pkg/security/lookup/procedure/oauth.go

@@ -313,3 +313,38 @@ func (o *OAuthClients) Revoke(ctx context.Context, token string) error {
 	}
 	return nil
 }
+
+// UpdateClient implements lookup.OAuthClientStore.
+func (o *OAuthClients) UpdateClient(ctx context.Context, client *sectypes.OAuthServerClient) error {
+	input, err := json.Marshal(client)
+	if err != nil {
+		return fmt.Errorf("failed to marshal client: %w", err)
+	}
+	var success bool
+	var errMsg sql.NullString
+	err = o.run.Run(func(db *sql.DB) error {
+		return db.QueryRowContext(ctx, fmt.Sprintf(`
+		SELECT p_success, p_error
+		FROM %s($1::jsonb)
+	`, o.procs.OAuthUpdateClient), input).Scan(&success, &errMsg)
+	})
+	if err != nil {
+		return fmt.Errorf("failed to update client: %w", err)
+	}
+	if !success {
+		return failure(errMsg, "failed to update client")
+	}
+	return nil
+}
+
+// DeleteClient implements lookup.OAuthClientStore.
+func (o *OAuthClients) DeleteClient(ctx context.Context, clientID string) error {
+	ok, errMsg, err := o.callNoData(ctx, o.procs.OAuthDeleteClient, clientID)
+	if err != nil {
+		return fmt.Errorf("failed to delete client: %w", err)
+	}
+	if !ok {
+		return failure(errMsg, "failed to delete client")
+	}
+	return nil
+}