Inline OAuth2 signing key in config

The OAuth2/OIDC server accepted its signing key via a file path
(key-file), while every other PEM key in the probod config (SAML
private key, ACME account key) is embedded inline. Switch the
field to a private-key string so the convention is uniform.

The signing key is operator-supplied material that must outlive
any process restart, so the bootstrap builder now treats
OAUTH2_SERVER_SIGNING_KEY as required and refuses to start
without one; silently minting a fresh key per boot would break
token validation across rollouts. The OAUTH2_SERVER_* env vars
otherwise flow through builder.Build like the existing SAML
block so the new OAuth2Server section is populated end-to-end.

Rework the e2e harness to render its config via bootstrap at
test setup, which removes the static
e2e/console/testdata/config.yaml and the previously generated
test-only PEM file. A per-run RSA key is minted via
bootstrap.GenerateOAuth2SigningKey (kept public for test
tooling) and injected through the builder env map. CI now
passes ACME_ROOT_CA inline instead of mutating a YAML on disk.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

e2e/console/testdata/config.yaml

@@ -1,99 +0,0 @@
-unit:
-  metrics:
-    addr: "localhost:19081"
-  tracing:
-    addr: "localhost:14317"
-    max-batch-size: 512
-    batch-timeout: 5
-    export-timeout: 30
-    max-queue-size: 2048
-
-probod:
-  base-url: "http://localhost:18080"
-  encryption-key: "thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA="
-  chrome-dp-addr: "localhost:9222"
-
-  api:
-    addr: "localhost:18080"
-    cors:
-      allowed-origins: ["http://localhost:18080"]
-    extra-header-fields: {}
-
-  pg:
-    addr: "localhost:5432"
-    username: "postgres"
-    password: "postgres"
-    database: "probod_test"
-    pool-size: 10
-
-  auth:
-    disable-signup: false
-    invitation-confirmation-token-validity: 3600
-    cookie:
-      name: "SSID"
-      domain: "localhost"
-      secret: "this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes"
-      duration: 24
-      secure: false
-    password:
-      pepper: "this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes"
-      iterations: 600000
-    oauth2-server:
-      signing-keys:
-        - key-file: "./testdata/oauth2_signing_key.pem"
-          kid: "test-key-1"
-          active: true
-      access-token-duration: 10
-      refresh-token-duration: 10
-      authorization-code-duration: 5
-      device-code-duration: 15
-
-  trust-center:
-    http-addr: ":10080"
-    https-addr: ":10443"
-
-  aws:
-    region: "us-east-1"
-    bucket: "probod-test"
-    access-key-id: "probod"
-    secret-access-key: "thisisnotasecret"
-    endpoint: "http://127.0.0.1:8333"
-
-  notifications:
-    mailer:
-      sender-name: "Probo Test"
-      sender-email: "no-reply@test.getprobo.com"
-      smtp:
-        addr: "localhost:1025"
-        tls-required: false
-      mailer-interval: 1
-    slack:
-      sender-interval: 60
-
-  llm:
-    providers:
-      openai:
-        type: "openai"
-        api-key: "thisisnotasecret"
-    defaults:
-      provider: "openai"
-      model-name: "gpt-4o"
-      temperature: 0.1
-      max-tokens: 4096
-
-  evidence-describer:
-    interval: 10
-    stale-after: 300
-    max-concurrency: 10
-
-  custom-domains:
-    renewal-interval: 3600
-    provision-interval: 30
-    cname-target: "custom.test.getprobo.com"
-    acme:
-      directory: "https://localhost:14000/dir"
-      email: "admin@test.getprobo.com"
-      key-type: "EC256"
-      root-ca: ""
-
-  connectors: []