identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests)

clients.sx (RFC 6749 §2) — confidential clients must present the correct
secret at the token endpoint (wrong → invalid_client); public clients are
identified but not authenticated; redirect_uris are pre-registered and
checked by exact-match valid_redirect (§3.1.2.2 + Security BCP). Standalone
module for now; wiring confidential-client auth into oauth exchange is a
follow-up. New tests/clients.sx. 149/149.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 138 / 138 tests passing**
+**Total: 149 / 149 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -15,6 +15,7 @@
 | ✅ | audit | 11 | 11 |
 | ✅ | federation | 12 | 12 |
 | ✅ | expiry | 8 | 8 |
+| ✅ | clients | 11 | 11 |
 
 
 Generated by `lib/identity/conformance.sh`.