[mykytanetipa]

Adds the OAuth discovery, client selection, and grant storage package that the CLI authentication stack builds on. It also includes an in-process OAuth server and protected A2A agent so tests run over real localhost HTTP without mocks or external identity providers. CLI commands are unchanged until #130.

Example:

as := oauthtest.NewAuthServer(t, oauthtest.ServerOptions{CIMD: true})
agent := oauthtest.NewProtectedAgent(t, as, oauthtest.AgentOptions{
    Card:   oauthtest.CardMetadataURL,
    Scopes: []string{"a2a.invoke"},
})

resp, _ := http.Get(agent.URL + "/tasks") // 401 with WWW-Authenticate: Bearer ...
challenges := oauth.ParseChallenges(resp.Header.Values("WWW-Authenticate"))

store := &oauth.FileStore{Dir: t.TempDir()}
key := oauth.NewGrantKey(as.URL, oauth.DefaultClientID, agent.URL, []string{"a2a.invoke"})
_ = store.Put(oauth.Grant{Key: key, AccessToken: "at_123"})

Protected agents can advertise where to sign in either up front on the agent card or reactively in a 401 Bearer challenge header. Discovery normalizes both paths into the same requirement structure, following challenge headers through Protected Resource Metadata to the server's OAuth or OpenID Connect metadata. Along the way, it enforces HTTPS outside loopback, same-origin redirects, and matching issuer and resource identifiers. A card that also accepts other credentials, such as an API key, marks the requirement as optional.

Once an authorization server is known, client matching picks the configured registration for that authority. If none is configured and the server advertises support, it falls back to the default client metadata document URL, which can be changed or turned off. That document is proposed in A2A PR 2405, so https://a2a-protocol.org/oauth/a2a-cli.json returns 404 until it is merged and deployed. Saved grants live on disk in an owner-only JSON file keyed by issuer, client ID, normalized agent URL, and scopes. That keying keeps tokens issued for one agent from ever being sent to another, and an OS file lock (flock or LockFileEx) coordinates concurrent CLI runs without leaving a stale lock behind after a crash.

Refs #98

[mykytanetipa]

Closing in favor of the a2a-go OAuth client (a2aproject/a2a-go#568, a2aproject/a2a-go#569, a2aproject/a2a-go#570) and the CLI changes built on it (mykytanetipa#6, mykytanetipa#7).