feat(oauth): add secure buyer authorization helpers

[bokelley]

Closes the buyer OAuth helper item in #1031.

What changed

• add exact-issuer RFC 8414 discovery with path-aware well-known URLs, DNS-pinned SSRF protection, bounded streaming, and one absolute DNS+HTTP deadline
• add pre-registered public-client authorization-code helpers with mandatory S256 PKCE, browser-session state binding, RFC 9207 issuer defenses, and RFC 8707 resource continuity
• add an atomic pending-flow store protocol plus a fixed-capacity, TTL-aware single-process reference implementation
• add one-shot token exchange with persisted endpoint/loopback authority, safe typed token projection, and sanitized errors
• export the stable handwritten surface and document production shared-store/secret-persistence requirements

This deliberately accepts an authorization-server issuer URL, not an MCP resource URL; resource-to-issuer discovery remains an RFC 9728 concern. It does not expose experimental AdCP 3.2 schema types.

Validation

• make lint typecheck-all
• uv run pytest -q — 7,235 passed, 77 skipped, 9 deselected, 1 xfailed
• focused OAuth/public API suite — 52 passed
• independent code/security and protocol reviews: approved

[aao-secretariat]

Ladon verdict: Approve

Approve — purely additive OAuth 2.0 helper with no blocking or medium findings.

What I checked:

• New src/adcp/oauth.py (888 net new lines): fail-closed buyer-side OAuth authorization-code + S256 PKCE helper. Reviewer confirms security-critical paths (state compare, consume-before-I/O replay safety, DNS-pinned SSRF-guarded transports, deadline-covers-DNS timeouts, secret-safe error surfaces) are correct and adversarially tested.
• Public surface change wired in with a matching public_api_snapshot.json update, type-check fixture, and README section — no public-API break, no type-layering violation.
• Correct feat(oauth): conventional-commit prefix; purely additive (2009 additions, 0 deletions), so no semver-break signal required.
• CI gates remain armed.
• high_risk is true only because src/adcp/__init__.py was modified — but the reviewer found no medium-or-higher concerns on that file, so the modification is presumed safe (row 5 does not fire). No deletions.
• gated_paths is false, so row 2 does not apply despite review_decision: REVIEW_REQUIRED.
• No no-auto-approve team match.

Findings: Only two low findings (correct replay-ordering note; id_token opaqueness observation), both omitted from blocking consideration.

No rows 1–8 fired → row 9 approve.