feat(oauth): Phase B — claude.ai protocol compatibility

Add 3 features for claude.ai Connectors compatibility:

- FEATURE-3: client_secret_basic auth on token endpoint (RFC 6749 §2.3.1)
- FEATURE-2: Token revocation endpoint /oauth/revoke (RFC 7009)
- FEATURE-4: resource parameter support with JWT aud claim (RFC 8707)

23 new tests (481 total), all passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/oauth/schemas.py

@@ -63,6 +63,7 @@ class AuthorizationCode(BaseModel):
     api_key_id: str | None = None  # API Key ID for scope/project inheritance
     api_key_project_id: str | None = None  # Project ID from API Key
     api_key_scope: str | None = None  # Scope from API Key
+    resource: str | None = None  # RFC 8707: Resource indicator
 
     def is_expired(self) -> bool:
         """Check if code is expired"""