identity: OAuth2 authorization-code flow as message protocol + PKCE (14 tests)

oauth.sx — RFC 6749 §4.1 as a state machine on one authz-server process:
authorize → {consent_required} → consent(allow|deny) → {code} → exchange
→ {ok, Token}. Exchange enforces single-use codes (§10.5, replay →
invalid_grant), client_id + redirect_uri binding (§4.1.3), and PKCE
(RFC 7636 plain) verifier match. Issued tokens are grant-backed via
token.sx so revocation stays real. 53/53.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/conformance.sh

@@ -32,6 +32,7 @@ SUITES=(
   "token|id-token-test-pass|id-token-test-count"
   "registry|id-registry-test-pass|id-registry-test-count"
   "api|id-api-test-pass|id-api-test-count"
+  "oauth|id-oauth-test-pass|id-oauth-test-count"
 )
 
 cat > "$TMPFILE" << 'EPOCHS'
@@ -47,10 +48,12 @@ cat > "$TMPFILE" << 'EPOCHS'
 (load "lib/identity/token.sx")
 (load "lib/identity/registry.sx")
 (load "lib/identity/api.sx")
+(load "lib/identity/oauth.sx")
 (load "lib/identity/tests/session.sx")
 (load "lib/identity/tests/token.sx")
 (load "lib/identity/tests/registry.sx")
 (load "lib/identity/tests/api.sx")
+(load "lib/identity/tests/oauth.sx")
 (epoch 100)
 (eval "(list id-session-test-pass id-session-test-count)")
 (epoch 101)
@@ -59,6 +62,8 @@ cat > "$TMPFILE" << 'EPOCHS'
 (eval "(list id-registry-test-pass id-registry-test-count)")
 (epoch 103)
 (eval "(list id-api-test-pass id-api-test-count)")
+(epoch 104)
+(eval "(list id-oauth-test-pass id-oauth-test-count)")
 EPOCHS
 
 timeout 600 "$SX_SERVER" < "$TMPFILE" > "$OUTFILE" 2>&1