Add OAuth2/OpenID Connect authorization server

Implement a full OAuth2 2.0 and OpenID Connect 1.0 authorization
server with support for authorization code flow (with PKCE),
refresh token rotation, device authorization grant, dynamic
client registration, token introspection, and token revocation.

Includes database schema, coredata layer, service logic, HTTP
handlers, OIDC discovery endpoint, and JWKS publishing.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/probod/auth_config.go

@@ -29,6 +29,21 @@ type AuthConfig struct {
 	SAML                                SAMLConfig         `json:"saml"`
 	Google                              OIDCProviderConfig `json:"google"`
 	Microsoft                           OIDCProviderConfig `json:"microsoft"`
+	OAuth2Server                        OAuth2ServerConfig `json:"oauth2-server"`
+}
+
+type OAuth2ServerConfig struct {
+	SigningKeys               []OAuth2SigningKeyConfig `json:"signing-keys"`
+	AccessTokenDuration       int                      `json:"access-token-duration"`
+	RefreshTokenDuration      int                      `json:"refresh-token-duration"`
+	AuthorizationCodeDuration int                      `json:"authorization-code-duration"`
+	DeviceCodeDuration        int                      `json:"device-code-duration"`
+}
+
+type OAuth2SigningKeyConfig struct {
+	KeyFile string `json:"key-file"`
+	KID     string `json:"kid"`
+	Active  bool   `json:"active"`
 }
 
 type CookieConfig struct {