Add project-scoped OIDC client registration and management

Implement operator-managed OIDC client registrations directly on the project detail page, with inline client rows and native popover dialogs for registration, editing and secret rotation matching existing project/role editing. Do not add separate client list/detail/form screens. Use existing localized forms, authorization, optimistic concurrency, and atomic history/outbox patterns. Public/confidential type and client ID are immutable. Support names, exact redirect URI allowlists, enable/disable, confidential-client secret issuance once and immediate rotation (hashed storage, no secrets in history/logs). Authorization code with mandatory S256 PKCE is the only planned flow; this slice supplies registration only, not functioning OIDC endpoints. Acceptance: operators can create/list/inspect/edit/disable/reactivate clients and rotate confidential secrets without JavaScript in both themes. Validate redirect URIs conservatively (HTTPS or explicit loopback HTTP, no fragments/userinfo/wildcards), tenant/project scope, revoked authorization, CSRF, stale versions and atomic rollback. Keep secrets outside ordinary models/history/outbox and return secret-bearing responses with no-store. Update docs and pass applicable Rust, synthetic DB and browser gates. Non-goals: discovery/authorization/token/UserInfo/JWKS endpoints, dynamic registration, deletion, arbitrary grant/scope configuration, production deployment. Verified outcome: client rows are integrated into project details with shared native popover dialogs for register/edit/rotate/issued secrets, including no-JavaScript use. No separate client GET pages remain. Names, exact URI allowlists and active state are editable; immutable client IDs/types/projects, single-use registration identifiers, confidential-only secret rotation, isolated SHA-256 digest storage, curated history/outbox and optimistic versions are enforced. Direct runtime SQL tests cover invalid redirect authorities, missing/revoked/foreign authority and project scope; service/HTTP tests cover atomic rollback, secret exclusion, stale edits, CSRF and worst-case form encoding. Browser journeys cover both themes, JS on/off, localized content, issuance/rotation, draft conflicts, mobile/tablet dialogs and fully visible row actions. Adjacent fixes make the header wrap on tablets and select Identity Admin explicitly in the existing user-access test. Validation: cargo fmt --check; strict all-target/all-feature Clippy; cargo test --workspace --all-features; python3 dev/run.py test (including all four new synthetic integration tests); python3 dev/run.py browser-test (eight preview variants plus four authenticated theme/JS journeys) all pass. Final screenshots inspected at desktop/tablet/phone widths. Final independent patch-scoped static review covered all 21 diffs and found no actionable findings; it did not execute tests. README and project/architecture guides updated. Existing diagrams remain explicitly documented as the migration-0011 snapshot rather than falsely described as complete. Changes are uncommitted on feature/manage-oidc-clients.