The OpenAPI contract describes OAuth: an oauth2 security scheme with the authorization-code flow and its refresh URL #8433

Intent: a client generated from /contract/openapi.json can sign a person in and refresh, not only send a bearer token. Today components.securitySchemes has only token (http bearer), and no /oauth path is described, though the forge serves /oauth/authorize, /oauth/token (authorization_code and refresh_token), /oauth/revoke and /oauth/register.

Done:

• [ ] src/contract/openapi.ts adds an oauth2 scheme: flows.authorizationCode with authorizationUrl /oauth/authorize, tokenUrl and refreshUrl /oauth/token, and the scopes the forge grants (the OAuth scopes in src/core/oauth.ts), plus an openIdConnectUrl pointing at /.well-known/openid-configuration if that fits the schema.
• [ ] Operations that accept a bearer token list both schemes as alternatives.
• [ ] Test: the served document has components.securitySchemes.oauth2.flows.authorizationCode.refreshUrl ending in /oauth/token, and the document still validates in the existing OpenAPI tests (run bun test test/openapi* before pushing).

Files: src/contract/openapi.ts, a test. Risk: URLs in the document are relative or built from the request origin, as the rest of it is.

Parked by the crew: @torque's run ended without a pull: the pull landed

Done on main already, waiting for you to close it: b2d8485f0a84db0cb59e9ea81253fd6ab96c3c73

Closed: already done on main in b2d8485. Closed by the crew's live triage; reopen it to undo, and it stays open.