feat(oauth): add --oauth-allow-issuer-mismatch - #8

What changes and why

Introduce --oauth-allow-issuer-mismatch for MCP OAuth integrations whose authorization-server discovery identifiers differ. This explicit option is intended for trusted providers and prints a warning to stderr without affecting JSON stdout.

• Pin the accepted metadata issuer for exact callback validation. TLS certificate verification, PKCE, state, and resource validation remain enabled.
• Use Public Suffix List domain handling, including private suffixes and IDNA, for gateway issuer compatibility without provider-specific allowlists.
• Support dynamically registered clients using none, client_secret_basic, or client_secret_post. Honor the registration response when exchanging codes and storing Vault refresh settings; never print or persist OAuth secrets locally.
• Update command help and the README, and add discovery, callback, client-authentication, and CLI-to-Vault regression coverage.

Pre-registered --oauth-client-id remains public-client-only. No client-secret command-line argument is introduced.

Compatibility

• No change to public command or configuration behavior.
• Adds --oauth-allow-issuer-mismatch and mcpoauth.Options.AllowIssuerMismatch, and extends dynamic client authentication support as described above. Existing leaf commands and credential-result output formats are unchanged.

How I tested it

Passed locally:

env -u GOROOT GOWORK=off go test -mod=readonly ./...
env -u GOROOT GOWORK=off go vet -mod=readonly ./...
env -u GOROOT GOWORK=off go build -mod=readonly ./cmd/ork
env -u GOROOT GOWORK=off go test -mod=readonly -race ./pkg/mcpoauth ./tests/e2e/commands
env -u GOROOT GOWORK=off go test -mod=readonly -race ./pkg/cmd/workspace -run OAuth -count=1
gofmt -l .
scripts/check-license-headers.sh
git diff --check

The command E2E fixtures exercise discovery, registration, PKCE callbacks, token exchange, Vault refresh configuration, and output redaction without a real login or external credential writes.

The broader workspace race check exposes existing global-state races in parallel help tests. These were reproduced on the unmodified base commit; the OAuth-focused race checks above pass.

AI assistance

• No AI assistance.
• AI-assisted. Tool: pi (OpenAI). Generated implementation, tests, documentation, and this PR draft. Verification: the local checks listed above and a review against the agreed behavior and repository standards.

Checklist

• Every commit is signed off. Human DCO sign-off is still pending.
• Commits with meaningful AI assistance carry one Assisted-by: trailer.
• Formatting, vet, tests, build, and license-header checks pass locally.
• Existing leaf-command coverage is retained; additional OAuth command E2E coverage is included. No commands were added, removed, or moved.
• The README is updated for the new behavior.