identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests)

clients.sx (RFC 6749 §2) — confidential clients must present the correct
secret at the token endpoint (wrong → invalid_client); public clients are
identified but not authenticated; redirect_uris are pre-registered and
checked by exact-match valid_redirect (§3.1.2.2 + Security BCP). Standalone
module for now; wiring confidential-client auth into oauth exchange is a
follow-up. New tests/clients.sx. 149/149.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,7 +1,7 @@
 {
   "language": "identity",
-  "total_pass": 138,
-  "total": 138,
+  "total_pass": 149,
+  "total": 149,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":24,"total":24,"status":"ok"},
@@ -13,6 +13,7 @@
     {"name":"cache","pass":9,"total":9,"status":"ok"},
     {"name":"audit","pass":11,"total":11,"status":"ok"},
     {"name":"federation","pass":12,"total":12,"status":"ok"},
-    {"name":"expiry","pass":8,"total":8,"status":"ok"}
+    {"name":"expiry","pass":8,"total":8,"status":"ok"},
+    {"name":"clients","pass":11,"total":11,"status":"ok"}
   ]
 }