[Bccorb]

Per-application PKCE and nonce opt-outs for OpenID Provider applications (epic #387). Stacked on #539. Uses @seamless-auth/types 0.34.0-next.4 (fells-code/seamless-auth-types#141 adds the fields).

What changed

• oidc_clients gains pkceRequired and nonceRequired, both DEFAULT true NOT NULL, so every existing application keeps PKCE.
• POST and PATCH /admin/applications accept both. pkceRequired: false is allowed only on a confidential client, and nonceRequired: false only once pkceRequired is false. The merged result of a patch is checked again, so turning PKCE back on while the nonce is waived is refused. Both writes already sit behind admin write and step-up.
• Each change is audited on its own: admin_oidc_application_pkce_updated and admin_oidc_application_nonce_updated, on create when false and on any patch that changes the value.
• Both fields are in every application response, so the dashboard and CLI can warn about an application with both off.
• GET /oidc/clients/:id sends urn:seamless:pkce_required: false for an opted-out confidential client, plus urn:seamless:nonce_required: false when the nonce is waived too.
• ADR 0001 D1 is amended: PKCE is required by default, with a per-client opt-out for confidential clients that keeps the nonce on unless separately disabled (RFC 9700 section 2.1.1). The reason is OpenID certification. With both off, the client relies on state and client authentication against code injection.

Checks (against types 0.34.0-next.4)

• npm run typecheck, npm run lint, npm run format:check: clean
• npm run coverage: 2741 passed, lines 99.23, branches 95.77
• Real stack with the edge branch, client secret application opted out: a code flow with a nonce and no PKCE works; with neither it gets invalid_request ("nonce is required when PKCE is not used"); with the nonce also waived, neither works; an application that has not opted out still needs PKCE.