identity: client-credentials grant (RFC 6749 §4.4, +9 tests)

oauth.sx now owns a client registry (loop/6) with register_client and the
client_credentials grant. A confidential client authenticates and gets a
token acting on its own behalf (subject = the client), no refresh token
(§4.4.3). A public client is unauthorized_client; any auth failure (unknown
client or wrong secret) is invalid_client — no client-existence oracle
(§5.2). identity-load-oauth! now pulls its deps. New tests/grants.sx.
158/158.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 149 / 149 tests passing**
+**Total: 158 / 158 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -16,6 +16,7 @@
 | ✅ | federation | 12 | 12 |
 | ✅ | expiry | 8 | 8 |
 | ✅ | clients | 11 | 11 |
+| ✅ | grants | 9 | 9 |
 
 
 Generated by `lib/identity/conformance.sh`.