feat(authbridge): add Okta token-exchange plugin

[huang195]

Summary

Implement an IdP plugin for Okta token exchange, conforming to the IdP-agnostic interface defined in #481.

Scope

• New plugin package under authbridge/authlib/plugins/ registered via RegisterPlugin.
• Okta org/custom authorization server token endpoint + OIDC discovery.
• Map RFC 8693 exchange onto Okta's token-exchange / OBO support, with scope/audience encoding per Okta conventions.
• Config schema (SchemaProvider) for issuer/auth-server, client credentials, scopes.
• Unit tests using the plugintesting harness; doc page under authbridge/docs/.

Blocked by

#481 (Phase 1 interface).

[akram]

The Okta provider uses the same RFC 7523 client assertion flow as Entra (#525). A generic implementation would cover both IdPs. The Okta provider should support both direct (Okta-native OAuth client) and federated (Keycloak JWT → Okta token) credential modes.

[huang195]

closing it for now as this is not our priority at the moment