identity: OAuth2 authorization-code flow as message protocol + PKCE (14 tests)

oauth.sx — RFC 6749 §4.1 as a state machine on one authz-server process:
authorize → {consent_required} → consent(allow|deny) → {code} → exchange
→ {ok, Token}. Exchange enforces single-use codes (§10.5, replay →
invalid_grant), client_id + redirect_uri binding (§4.1.3), and PKCE
(RFC 7636 plain) verifier match. Issued tokens are grant-backed via
token.sx so revocation stays real. 53/53.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,11 +1,12 @@
 {
   "language": "identity",
-  "total_pass": 39,
-  "total": 39,
+  "total_pass": 53,
+  "total": 53,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":9,"total":9,"status":"ok"},
     {"name":"registry","pass":9,"total":9,"status":"ok"},
-    {"name":"api","pass":10,"total":10,"status":"ok"}
+    {"name":"api","pass":10,"total":10,"status":"ok"},
+    {"name":"oauth","pass":14,"total":14,"status":"ok"}
   ]
 }