fix: OAuth2/OIDC standards compliance for HTTP handlers

[lakhansamani]

Summary

Comprehensive audit and fix of all HTTP handlers against OAuth2 and OpenID Connect standards (RFC 6749, RFC 7636, RFC 7009, RFC 6750, OIDC Core/Discovery).

Critical Bugs Fixed

• Missing return after error responses in token.go (line 64), oauth_callback.go (lines 263, 270) — code continued execution after sending error JSON, causing nil pointer dereferences and undefined behavior
• Index out of bounds panic in oauth_callback.go — accessed sessionSplit[3] with only len < 3 bounds check

RFC 6749 (OAuth 2.0) — Token Endpoint

• Added REQUIRED token_type: "Bearer" to token response (§5.1)
• Fixed all error codes to standard values: unsupported_grant_type, invalid_request, invalid_client, invalid_grant (§5.2)
• Invalid client via HTTP Basic Auth now returns 401 with WWW-Authenticate header (§5.2)
• Authorization code deletion made synchronous to prevent race condition allowing code reuse (§4.1.2)

RFC 7009 (Token Revocation) — Revoke Endpoint

• Returns HTTP 200 for invalid/unknown tokens — prevents token scanning attacks (§2.2)
• Accepts application/x-www-form-urlencoded (standard) alongside JSON (backward compat)
• Supports standard token field name and token_type_hint parameter

RFC 6750 (Bearer Token) — UserInfo Endpoint

• Added WWW-Authenticate: Bearer header on all 401 responses (§3)
• Uses standard error codes: invalid_token, invalid_request

OIDC Discovery 1.0 — Discovery Endpoint

• id_token_signing_alg_values_supported now always includes RS256 (MUST per spec)
• Added: grant_types_supported, token_endpoint_auth_methods_supported, code_challenge_methods_supported, revocation_endpoint, end_session_endpoint

RFC 7636 (PKCE) — Authorize Endpoint

• Added code_challenge_method parameter support (S256 only)
• Removed non-standard nonce from authorization code response (§4.1.2: only code + state)

Tests & Docs

• Added oauth_standards_compliance_test.go with 20+ test cases covering all standards
• Added docs/oauth2-oidc-endpoints.md — complete endpoint reference with examples

Test plan

• Run go build ./... — verify clean build
• Run go vet ./internal/http_handlers/... — no warnings
• Run compliance tests: go test -v -run "TestOpenIDDiscovery|TestTokenEndpoint|TestRevocation|TestUserInfo|TestAuthorize|TestJWKS" ./internal/integration_tests/ (requires Postgres)
• Verify /.well-known/openid-configuration includes all required OIDC fields
• Test /oauth/token error responses match RFC 6749 §5.2 error codes
• Test /oauth/revoke returns 200 for invalid tokens per RFC 7009
• Test /userinfo returns WWW-Authenticate header on 401
• Verify PKCE flow with code_challenge_method=S256
• Verify backward compatibility (existing clients still work)