OAuth 2.1 / OIDC Client model
Mirrors the oauth_clients table and PostgreSQL enums. Includes small policy helpers (public/confidential, PKCE, grants).
oauth_clients