[Bccorb]

What

A new oidcApplication module for the admin routes that manage the OpenID Provider's applications (clients) and resources on the API (ADR 0001 in seamless-auth-api, D5, D6, D10, D12), plus the hosted_ui branding key from the widened scope.

• Applications. Create, update, keys, secret, list and response schemas. Rules held by checkOidcApplication (exported so the API re-runs them on the merged result of a partial update):
  • Public clients use none (PKCE only) and cannot hold keys, a secret or client_credentials.
  • Confidential clients default to private_key_jwt; keys are only accepted with it, and only one of JWKS or JWKS URI.
  • refresh_token needs authorization_code or the device grant; authorization_code needs a redirect URI.
  • The device grant is deviceFlowEnabled, first-party only (D10).
  • Implicit, hybrid, password and client_secret_jwt cannot be expressed (#410).
• Redirect URIs (RFC 8252, api#508). Exact https, http only on 127.0.0.1 / [::1] (any port at request time), private-use schemes in reverse domain form. localhost, fragments and credentials are refused. oidcRedirectUriProblem / oidcRedirectUriKind expose the rule.
• Resources and scopes (api#509). Resource identifier (absolute https/http/urn URI, no query or fragment), declared scopes (RFC 6749 tokens; OIDC scopes and seamless reserved), and each application's allowed resources and scopes.
• Branding (api#406). hosted_ui on SystemConfigSchema (default null) and the patch schema: app name override, https logo, hex colors, font stack. Every value is constrained so it cannot break out of the CSS variables the edge injects.
• admin_oidc_* auth event types and OidcApplicationRoutes.

Shipped in the existing pre mode as a minor changeset, so it releases as 0.34.0-next.N.

Closes #97

Checks

• npm run typecheck: pass
• npm run lint: pass
• npm run format:check: pass
• npm test: 23 files, 448 tests pass (79 new)
• npm run build, npm run test:zod-floor: pass