identity: OAuth2 authorization-code flow as message protocol + PKCE (14 tests)

oauth.sx — RFC 6749 §4.1 as a state machine on one authz-server process:
authorize → {consent_required} → consent(allow|deny) → {code} → exchange
→ {ok, Token}. Exchange enforces single-use codes (§10.5, replay →
invalid_grant), client_id + redirect_uri binding (§4.1.3), and PKCE
(RFC 7636 plain) verifier match. Issued tokens are grant-backed via
token.sx so revocation stays real. 53/53.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 39 / 39 tests passing**
+**Total: 53 / 53 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -8,6 +8,7 @@
 | ✅ | token | 9 | 9 |
 | ✅ | registry | 9 | 9 |
 | ✅ | api | 10 | 10 |
+| ✅ | oauth | 14 | 14 |
 
 
 Generated by `lib/identity/conformance.sh`.