Support OAuth client_secret_basic

[MisterJimson]

Summary

• persist a token endpoint authentication method for each OAuth client
• expose client_secret_post and client_secret_basic in the OAuth client API and form
• use the selected method for authorization-code exchange, refresh, and client-credentials minting
• preserve client_secret_post as the default for existing clients
• add PostgreSQL and SQLite migrations plus local and Cloudflare D1 compatibility

Closes #1447

Root cause

The low-level token helper already supported HTTP Basic authentication, but the OAuth client model did not persist that choice and its callers did not pass it through. As a result, confidential clients always sent their credentials in the request body.

Validation

• bun run format:check
• bun run lint
• bun run typecheck (43 packages)
• bun run test (37 tasks)
• core OAuth flow tests (26 tests)
• core OAuth client-list tests (5 tests)
• local app tests (72 tests)
• Cloudflare data-migration tests (5 tests)

Draft notes

• Browser/e2e recording is not yet included.