Add OAuth 2.0 PKCE login for native apps and optional GitHub login

[AMDphreak]

Summary

• Add an OAuth 2.0 authorization-code + PKCE flow (RFC 7636 / RFC 8252) so CLI/GUI tools can log in via a loopback callback instead of posting a registry password.
• GET /oauth/authorize, POST /oauth/token, and POST /oauth/revoke issue Bearer tokens that work on existing owner routes (Authorization: Bearer). Redirect URIs are restricted to 127.0.0.1 / localhost / [::1].
• Optional GitHub OAuth login (/login/github + /login/github/callback) when github-oauth-client-id / github-oauth-client-secret are set. This is a step toward Implement OAuth support for Github login & package management #475; org-based package management is not in this PR.

Test plan

• dub test (PKCE RFC 7636 vector, loopback URI checks, Bearer header parsing)
• Unconfigured instance: login page has no GitHub link; GET /login/github returns 503
• Browser: GET /oauth/authorize?response_type=code&client_id=native&redirect_uri=http://127.0.0.1:<port>/callback&code_challenge=<S256>&code_challenge_method=S256&state=xyz redirects to login, then consent, then the loopback callback with code
• Deny on consent redirects with error=access_denied
• Invalid redirect_uri (non-loopback) shows an error page and does not redirect
• POST /oauth/token with matching code_verifier returns a Bearer token; reuse of the same code fails
• Authorization: Bearer <token> can POST /register_package (or load /my_packages) as the logged-in user
• With GitHub OAuth App credentials: login page shows GitHub, callback creates/links the userman session

See api-docs/oauth.md for the client flow.

Made with Cursor