feat: add OAuth 2.1 authorization server module

[shivdeep1]

Summary

• New airlock/oauth/ module with OAuth 2.1 authorization server
• Client Credentials grant with private_key_jwt (Ed25519) authentication
• RFC 8693 Token Exchange for delegation chains with scope narrowing
• EdDSA-signed JWT access tokens with trust score claims
• Token introspection with live trust data (RFC 7662)
• OIDC discovery and JWKS endpoints
• Dynamic client registration (RFC 7591)
• Feature-flagged: AIRLOCK_OAUTH_ENABLED (default true)

Test plan

• OAuth token endpoint returns valid JWT (54 new tests)
• Client credentials grant verifies Ed25519 assertion
• Token exchange produces scope-narrowed child tokens
• Delegation depth limit enforced
• Cascade revocation propagates to child tokens
• Introspection returns live trust data
• All existing tests pass (814 total, 0 regressions)