Hosted apps sign in through OpenID Connect: the scaffold registers a client and verifies id_tokens instead of x-forge-identity #749

Follows #666. The forge is an OpenID provider and docs/APPS.md says how an app signs a person in through it, but the app scaffold (src/apps/scaffold.ts, src/who.ts in the template) still reads the HMAC-signed x-forge-identity header.

Acceptance:

• [ ] the scaffold's sign-in is the OIDC code flow with PKCE against FORGE_URL, registering its redirect URI on first boot and storing the client id under FORGE_APP_DATA
• [ ] a preview and production each register their own redirect URI
• [ ] once no app reads them, the identity headers and FORGE_APP_IDENTITY_KEY are retired in a separate change, named in docs/APPS.md
• [ ] test/scaffold.test.ts signs a person into the scaffold through the forge