feat(auth): add superadmin support for OAuth clients

* Introduce Superadmin field in OAuthClient configuration
* Implement IsSuperadmin method in OAuthRegistry
* Update identityAdmin to check superadmin status via OAuthRegistry
* Add tests for OAuthRegistry superadmin functionality

internal/auth/oauth_registry.go

@@ -31,3 +31,18 @@ func (o *OAuthRegistry) Lookup(clientID string, clientSecret string) (string, bo
 	}
 	return "", false
 }
+
+// IsSuperadmin reports whether keyID (as returned by Lookup) belongs to an
+// OAuth client configured with superadmin: true.
+func (o *OAuthRegistry) IsSuperadmin(keyID string) bool {
+	for _, client := range o.clients {
+		id := client.ID
+		if id == "" {
+			id = client.ClientID
+		}
+		if id == keyID {
+			return client.Superadmin
+		}
+	}
+	return false
+}