Function resolve_oauth_user 

async fn resolve_oauth_user(
    conn: &mut PgConnection,
    token: &SecretString,
    token_hmac_key: &SecretString,
) -> Result<(User, DateTime<Utc>), ControllerError>

Resolve an opaque Bearer access token to the local user that owns it.

Pure DB work (no actix, no cache) so it can be unit-tested directly. Flow: digest the token → look up a still-valid oauth_access_tokens row → reject sender-constrained (DPoP) tokens (this API is Bearer-only, so find_valid_for_sender is deliberately not used) → require the issuing client to allow Bearer tokens → require the exercise-services scope → load the user.

Also returns the token’s expires_at, so the caller can cap cache TTL to it.