feat(auth): add superadmin support for OAuth clients

* Introduce Superadmin field in OAuthClient configuration
* Implement IsSuperadmin method in OAuthRegistry
* Update identityAdmin to check superadmin status via OAuthRegistry
* Add tests for OAuthRegistry superadmin functionality

internal/app/admin_identity.go

@@ -17,13 +17,21 @@ import (
 )
 
 type identityAdmin struct {
-	pool    *pgxpool.Pool
-	keyring *auth.Keyring
-	logger  *slog.Logger
+	pool          *pgxpool.Pool
+	keyring       *auth.Keyring
+	oauthRegistry *auth.OAuthRegistry
+	logger        *slog.Logger
 }
 
-func newIdentityAdmin(pool *pgxpool.Pool, keyring *auth.Keyring, logger *slog.Logger) *identityAdmin {
-	return &identityAdmin{pool: pool, keyring: keyring, logger: logger}
+func newIdentityAdmin(pool *pgxpool.Pool, keyring *auth.Keyring, oauthRegistry *auth.OAuthRegistry, logger *slog.Logger) *identityAdmin {
+	return &identityAdmin{pool: pool, keyring: keyring, oauthRegistry: oauthRegistry, logger: logger}
+}
+
+func (a *identityAdmin) isSuperadmin(keyID string) bool {
+	if a.keyring != nil && a.keyring.IsSuperadmin(keyID) {
+		return true
+	}
+	return a.oauthRegistry != nil && a.oauthRegistry.IsSuperadmin(keyID)
 }
 
 func loadIdentityKeyring(ctx context.Context, pool *pgxpool.Pool, keyring *auth.Keyring) error {
@@ -71,7 +79,7 @@ func (a *identityAdmin) handler() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodGet {
 			keyID, ok := auth.KeyIDFromContext(r.Context())
-			if !ok || a.keyring == nil || !a.keyring.IsSuperadmin(keyID) {
+			if !ok || !a.isSuperadmin(keyID) {
 				writeJSON(w, http.StatusForbidden, map[string]string{"error": "superadmin API key required"})
 				return
 			}

internal/app/app.go

@@ -200,7 +200,7 @@ func routes(logger *slog.Logger, cfg *config.Config, info buildinfo.Info, db *st
 	enrichmentRetryer := tools.NewEnrichmentRetryer(context.Background(), db, bgMetadata, cfg.Capture, cfg.AI.Metadata.Timeout, activeProjects, logger)
 	backfillTool := tools.NewBackfillTool(db, bgEmbeddings, activeProjects, logger)
 	adminActions := newAdminActions(backfillTool, enrichmentRetryer, logger)
-	identityAdmin := newIdentityAdmin(db.Pool(), keyring, logger)
+	identityAdmin := newIdentityAdmin(db.Pool(), keyring, oauthRegistry, logger)
 
 	toolSet := mcpserver.ToolSet{
 		Capture:              tools.NewCaptureTool(db, embeddings, cfg.Capture, activeProjects, enrichmentRetryer, backfillTool),