[Bccorb]

Stacked on #525 (feat/oidc-applications). Review that one first.

What

Admin management of OpenID Provider resources and scopes (#509, ADR 0001 D5 and D11). Reads need admin:read. Writes need admin:write plus a fresh step-up and are audited.

Route
GET, POST /admin/resources	list, create
GET, PATCH, DELETE /admin/resources/:id	get, update name, scopes or TTL, delete
GET, PUT /admin/applications/:id/resources	read and replace the resources and scopes an application may use

• Identifier. It becomes the aud of the resource's access tokens and cannot change. It cannot be the API ISSUER or oidc_issuer.
• Scopes. Resource scopes are RFC 6749 tokens. The OIDC scopes and seamless are reserved.
• Application grants. An application may only be granted scopes the resource declares. Dropping a scope or deleting a resource removes it from every application.
• Signing. These are the rows POST /oidc/sign already checks (getOidcClientResourceScopes), so aud equals the resource and scope is a subset of the application's grant. A Postgres test covers the path from the admin writes to that lookup.

Contract change. These are new access passthroughs for seamless-auth-server#241, dashboard#296 and cli#276.

Types

Locks the published @seamless-auth/types 0.34.0-next.1 (fells-code/seamless-auth-types#125).

Part of #509

Checks (local, against the published types 0.34.0-next.1)

• npm run typecheck, npm run lint, npm run format:check, npm run build: pass
• npm run coverage: 166 files, 2615 tests pass; 99.02% lines, 95.72% branches
• TEST_DB=postgres project on a scratch Postgres 16: 49 tests pass
• /security-review over both commits: no findings