Add OAuth2 Client ID Metadata Document support

MCP connectors such as ChatGPT and Claude register via HTTPS
client_id URLs instead of pre-provisioned GIDs. Fetch and cache
their metadata documents, upsert clients on first use, and
advertise CIMD in OIDC discovery when allowed URLs are configured.

Signed-off-by: Bryan Frimin <bryan@probo.com>

contrib/helm/charts/probo/templates/deployment.yaml

@@ -135,6 +135,10 @@ spec:
                 secretKeyRef:
                   name: {{ include "probo.fullname" . }}
                   key: oauth2-signing-key
+            {{- if .Values.probo.oauth2.cimdAllowedClientIds }}
+            - name: OAUTH2_SERVER_CIMD_ALLOWED_CLIENT_IDS
+              value: {{ join "," .Values.probo.oauth2.cimdAllowedClientIds | quote }}
+            {{- end }}
             - name: AUTH_PASSWORD_ITERATIONS
               value: {{ .Values.probo.auth.passwordIterations | quote }}
             {{- if .Values.probo.saml.enabled }}

contrib/helm/charts/probo/values.yaml

@@ -191,6 +191,9 @@ probo:
   # Generate with: openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048
   oauth2:
     signingKey: ""
+    # Comma-separated HTTPS client metadata document URLs allowed for CIMD
+    # OAuth clients (e.g. MCP connectors). Leave empty to disable CIMD.
+    cimdAllowedClientIds: []
 
   # CORS configuration
   cors: