feat(auth): add OAuth 2.1 and OIDC support

[romanbsd]

Why

Native clients need standards-based delegated authentication without sharing browser cookies or long-lived API keys.

Summary

• Upgrade Better Auth runtime packages from 1.6.25 to 1.7.2.
• Add OAuth 2.1 authorization code flow with PKCE and refresh rotation.
• Add OpenID Connect discovery, JWKS, ID tokens, and protected-resource metadata.
• Resolve sessions, API keys, and bearer tokens into one request principal.
• Enforce crm.read and crm.write scopes alongside existing workspace roles.
• Add consent screens, client management commands, a Prisma migration, tests, and implementation documentation.

UX flow

Native client
└─ Open authorization request with PKCE
   └─ Sign in through an existing CRM identity provider
      └─ Review consent for a custom client
         └─ Return an authorization code
            └─ Exchange and refresh scoped tokens

Validation

• bun run check-types
• bun run lint
• bun run lint:slop
• Focused OAuth API tests: 12 passed.
• Auth package tests: 42 passed.
• Webpack production build passed.
• git diff --check

Known failure

The full suite has one unrelated agent failure in keyless-brand.integration.spec.ts.
The test expects FAILED, but the task remains PENDING.

---

Summary by cubic

Adds OAuth 2.1 and OIDC support for native clients and introduces an XMPP agent gateway for external tool invocation. Upgrades better-auth to 1.7.2 and unifies all request credentials (sessions, API keys, OAuth tokens) into a single request principal.

Features

• OAuth 2.1 authorization code flow with PKCE, refresh token rotation, OIDC discovery, JWKS, and a consent screen.
• XMPP gateway that exposes export tools over XMPP, with task persistence in PostgreSQL, cancellation, and configurable XMPP_* environment variables.

Migration and compatibility

• Requires a new Prisma migration and the new XMPP_* environment variables for the gateway.
• Slack social connection now uses authClient.linkSocial instead of oauth2.link.
• API key handling now goes through the unified principal resolver; the session-only middleware now checks credential kind.

^{Written for commit e7d3a77. Summary will update on new commits.}

[vercel]

@romanbsd is attempting to deploy a commit to the Comp AI - PoC Team on Vercel.

A member of the Team first needs to authorize it.