4.982.0

Summary

• Registers the five Resgrid mobile/public OAuth clients—responder, unit, ic, dispatch, and bigboard—when the API starts.
• Configures these clients with the token endpoint, password, refresh-token, MFA completion, and external-token grants, plus the email, profile, and mobile scopes.
• Makes client registration idempotent and self-correcting: missing clients are created, and existing client types or permissions are restored to the expected configuration.
• Sets the registered app client IDs as the default trusted clients eligible for the long-lived refresh-token/API session lifetime.
• Updates external-token/SSO authentication to determine refresh-token lifetime from the validated OpenIddict request, matching password-grant behavior.
• Preserves the short lifetime for anonymous requests and supports older clients that omit client_id.
• Adds coverage for:
  • Successful sign-in and refresh flows for every registered app client.
  • App-specific refresh-token ownership.
  • Anonymous sign-in lifetime behavior and migration to an identified app client on refresh.
  • Rejection of unknown client IDs without consuming the grant.
  • MFA completion and SSO exchanges using registered app clients.
  • Client registration, permission correction, startup registration, and configuration alignment.
• Adds the EF Core in-memory dependency required to test OpenIddict application and token stores.