OIDC client registry

Register third-party relying parties (RPs) that authenticate users against this tenant’s built-in OIDC provider — e.g. Nextcloud, Grafana, Outline, your own SaaS app. The RP reads metadata from the discovery URL below, then redirects users to /oauth2/v1/authorize with its client_id. Saved entries are picked up by the IdP on the next request without a restart (file is mtime-watched). Built-in codeb-admin client is reserved — the bundled admin UI uses it and cannot be edited.