Add identity-scoped OAuth token management

Let users create, list, and revoke manual bearer tokens from
/me/oauth-tokens, scoped to their identity rather than an
organization. Manual tokens store a null client_id and are
authorized with a self-manage IAM policy.

Wire Connect GraphQL on Identity (list, create, revoke), add
console UI with scoped create flow and credentials dialog, and
cover the flow in e2e tests. Fix list pagination ordering and
keep the Relay connection in sync after create.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/connect/v1/base_resolvers.go

@@ -122,6 +122,16 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 
 			return types.NewPersonalAPIKey(personalAPIKey), nil
 		}
+	case coredata.OAuth2AccessTokenEntityType:
+		action = iam.ActionOAuth2AccessTokenGet
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
+			accessToken, err := r.iam.OAuth2ServerService.GetAccessTokenByID(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+
+			return types.NewOAuth2AccessToken(accessToken), nil
+		}
 	case coredata.SCIMConfigurationEntityType:
 		action = iam.ActionSCIMConfigurationGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
@@ -256,6 +266,18 @@ func (r *queryResolver) SignUpEnabled(ctx context.Context) (bool, error) {
 	return r.iam.IsSignUpEnabled(), nil
 }
 
+// Oauth2ScopesSupported is the resolver for the oauth2ScopesSupported field.
+func (r *queryResolver) Oauth2ScopesSupported(ctx context.Context) ([]string, error) {
+	apiScopes := r.iam.Authorizer.APIScopes()
+
+	scopes := make([]string, len(apiScopes))
+	for i, scope := range apiScopes {
+		scopes[i] = scope.String()
+	}
+
+	return scopes, nil
+}
+
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }