Inline OAuth2 signing key in config

The OAuth2/OIDC server accepted its signing key via a file path
(key-file), while every other PEM key in the probod config (SAML
private key, ACME account key) is embedded inline. Switch the
field to a private-key string so the convention is uniform.

The signing key is operator-supplied material that must outlive
any process restart, so the bootstrap builder now treats
OAUTH2_SERVER_SIGNING_KEY as required and refuses to start
without one; silently minting a fresh key per boot would break
token validation across rollouts. The OAUTH2_SERVER_* env vars
otherwise flow through builder.Build like the existing SAML
block so the new OAuth2Server section is populated end-to-end.

Rework the e2e harness to render its config via bootstrap at
test setup, which removes the static
e2e/console/testdata/config.yaml and the previously generated
test-only PEM file. A per-run RSA key is minted via
bootstrap.GenerateOAuth2SigningKey (kept public for test
tooling) and injected through the builder env map. CI now
passes ACME_ROOT_CA inline instead of mutating a YAML on disk.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

.github/workflows/make.yaml

@@ -401,29 +401,14 @@ jobs:
           SKIP_APPS=1 make bin/probod
           wait $STACK_PID
       - run: "make stack-ps"
-      - name: "Inject root CA into e2e config"
-        run: |
-          python3 << 'EOF'
-          import yaml
-
-          with open('compose/pebble/certs/rootCA.pem', 'r') as f:
-              root_ca = f.read()
-
-          with open('e2e/console/testdata/config.yaml', 'r') as f:
-              config = yaml.safe_load(f)
-
-          config['probod']['custom-domains']['acme']['root-ca'] = root_ca
-
-          with open('e2e/console/testdata/config.yaml', 'w') as f:
-              yaml.dump(config, f, default_flow_style=False, allow_unicode=True)
-          EOF
       - name: "Run e2e tests"
         env:
           PROBO_E2E_BINARY: "${{ github.workspace }}/bin/probod"
-          PROBO_E2E_CONFIG: "${{ github.workspace }}/e2e/console/testdata/config.yaml"
           GOTESTSUM_FORMAT: "testname"
           GOTESTSUM_JUNITFILE: "junit-e2e.xml"
-        run: "CGO_ENABLED=1 go tool gotestsum -- -race -cover -coverprofile=coverage.out -count=1 ./e2e/console/..."
+        run: |
+          ACME_ROOT_CA="$(cat compose/pebble/certs/rootCA.pem)" \
+            CGO_ENABLED=1 go tool gotestsum -- -race -cover -coverprofile=coverage.out -count=1 ./e2e/console/...
       - name: "Upload test results"
         uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7
         if: "always()"