Function resolve_oauth_user 

async fn resolve_oauth_user(
    conn: &mut PgConnection,
    token: &SecretString,
    token_hmac_key: &SecretString,
) -> Result<(User, DateTime<Utc>), ControllerError>

Resolve an opaque Bearer access token to the local user that owns it, requiring the exercise-services scope.

Pure DB work (no actix, no cache) so it can be unit-tested directly. Also returns the token’s expires_at, so the caller can cap cache TTL to it.