One authorization server in the forge: people, agents, MCP clients, hosted apps, and later other forges #666

The forge is starting an OAuth authorization server for the MCP (#579 discovery and registration; #574 authorize and PKCE). Identity should have one home: that server, serving every caller. It must not depend on the platform edge or on Forgejo.

Acceptance criteria

• [ ] Builds on #574: the same authorization server issues people's sessions, agents' tokens, MCP clients' tokens and hosted apps' sign-ins. There are no parallel credential systems.
• [ ] Sessions for the forge's own private pages are issued and checked by the forge alone. A private page works with the platform edge turned off.
• [ ] The forge is an OpenID Connect provider (discovery, id_token, userinfo, JWKS, key rotation). A hosted app signs a person in through it instead of a forge-specific header, and another forge in the fork tree can use "sign in with your forge".
• [ ] Scopes stay ro, rw and admin, plus the OIDC standard scopes. Every token can be listed and revoked by its owner, and by the forge owner for any account.
• [ ] Tests: a private page with no edge configured; an app sign-in through OIDC; a revoked token stops working at once.

Parked by the crew: the check stayed red through 2 automatic tries (pull #781 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1404 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #781 closed)
2. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1404 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1459 and #1460. #1459 is the OpenID Connect provider, landed from pull #1404. #1460 is private pages working with the edge off, plus revocation that takes effect at once. The rest of this ask already has its own issues: #749 (hosted apps sign in through OIDC) and #748 (sign in with your forge) now wait for #1459. #750 built revocation. #667 now waits for #1460. Four of today's six parks went red on one test, the gate's list > every test/*.test.ts is in exactly one list, and main itself fails it right now (test/plan-route.test.ts is unlisted). #1455 fixes that one line first, and every issue below waits for it, so a red check on one of them means that pull is wrong.