Address remaining compliance portal review nits

Fill in certificate renewal processing, preserve OAuth and JWKS
edge cases, embed the compliance-portal app in production builds,
and close the smaller portal routing and n8n update gaps.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/iam/oauth2/discovery.go

@@ -83,7 +83,14 @@ func AuthorizationURLWithQuery(
 		return "", fmt.Errorf("cannot parse authorization endpoint: %w", err)
 	}
 
-	u.RawQuery = query.Encode()
+	merged := u.Query()
+	for key, values := range query {
+		for _, value := range values {
+			merged.Add(key, value)
+		}
+	}
+
+	u.RawQuery = merged.Encode()
 
 	return u.String(), nil
 }