Add OAuth session support via OAuthSession mixin

[krystofyah]

Summary

An alternative approach to adding OAuth to the python client largely based on @zzstoatzz's https://github.com/zzstoatzz/atproto OAuth implementation fork but with a few main differences:

1. uses an OAuthSession mixin to add oauth methods to the atproto_client.Client
2. removes the stores from the Client. This approach requires storing sessions to be handled outside of the client
3. currently does not have async methods
4. mixin overwrites client's invoke method to make authenticated requests so that all namespace methods still work as they do for regular sessions. For example you can make calls like client.getPosts or client.app.bsky.feed.getFeedSkeleton` after establishing a session via oauth

Components

• OauthSessionMethodsMixin - OAuth flow handling (PAR, token exchange, refresh)
• DPoPManager - DPoP proof generation and nonce management
• PKCEManager - PKCE challenge/verifier generation
• OAuthSession - OAuth session state management

Usage

from atproto_client import Client

# 1. Create client with OAuth configuration
client = Client(
    client_id='https://myapp.example.com/client-metadata.json',
    redirect_uri='https://myapp.example.com/callback',
    scope='atproto',
)

# 2. Start authorization flow
auth_url, state, oauth_state = client.start_authorization('user.bsky.social')
# store oauth_state and redirect user to auth_url...

# 3. Handle callback (after user authorizes and is redirected back)
# callback params: ?code=xxx&state=xxx&iss=xxx

# get state from storage
oauth_state = ...
session = client.handle_callback(
    code=callback_params['code'],
    iss=callback_params['iss'],
    oauth_state=oauth_state,  # stored from step 2
)

# 4. Client is now authenticated - make API calls
profile = client.app.bsky.actor.get_profile({'actor': session.did})

# 5. Restore session later
client.import_oauth_session(session)

Testing

• added tests for unit tests for PKCE, DPoP, and OAuth mixin
• Manual testing with OAuth flow with django application

[MarshalX]

Hey @zzstoatzz and @krystofyah! Thank you for working on it. Could you please help me to understand on which PR should I look for as the main one?

Also, I do see in attached PR by @zzstoatzz that mixin approach does not fit well into 3d parties projects.

Having dpop.py and pkce.py in method_mixins folder is a bit strange to me. Since we do have atproto_crypto package. Also, I do see that official SDK separated OAuth into isolated packages. Which I could see in @zzstoatzz pull request (atproto_oauth)

[zzstoatzz]

in my attempted adoption of the mixin pattern it appeared to cause complexity, iirc, it seemed like the mixin pattern might be more complex for per-request client situations as opposed to single clients. to be fair that could have been for reasons idiosyncratic to the use case. will do a little more digging and clean up my PR when time allows, happy to coordinate / merge efforts with @krystofyah if that works out!