Add environment variable support for OIDC client secret

[JAORMX]

Summary

Add support for loading OIDC client secret from TOOLHIVE_OIDC_CLIENT_SECRET environment variable in the token validator. This is preparatory work for Kubernetes-native secret injection via SecretKeyRef.

Changes

• ✅ Added os import to pkg/auth/token.go
• ✅ Added environment variable fallback in NewTokenValidator()
• ✅ Loads from TOOLHIVE_OIDC_CLIENT_SECRET when config.ClientSecret is empty

Behavior

Backward Compatible:

• If environment variable is not set → uses config.ClientSecret as before
• If config.ClientSecret is set → uses that value (no change)
• If config.ClientSecret is empty AND env var is set → uses env var value

Use Case:
This enables Kubernetes operators to inject OIDC client secrets via environment variables sourced from Kubernetes Secrets, without embedding secrets in ConfigMaps or YAML manifests.

Testing

• ✅ No functional change when environment variable is not set
• ✅ All existing tests pass
• ✅ Linter passes

Follow-up Work

This is Part 1 of 2 for implementing #2321:

• Part 1 (this PR): Runtime support for environment variable
• Part 2 (Add SecretKeyRef support to InlineOIDCConfig for enhanced secret management #2324): CRD changes, controller integration, and full SecretKeyRef support

Part 2 will add:

• ClientSecretRef field to InlineOIDCConfig CRD
• Controller logic to inject secrets via environment variables
• Examples and documentation

Related

Related to #2321

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.13%. Comparing base (374b73b) to head (23ef2c3).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/auth/token.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2325      +/-   ##
==========================================
+ Coverage   54.11%   54.13%   +0.01%     
==========================================
  Files         239      239              
  Lines       23270    23273       +3     
==========================================
+ Hits        12592    12598       +6     
+ Misses       9508     9499       -9     
- Partials     1170     1176       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[lujunsan]

LGTM