fix(auth): use standard OAuth for Agent authority

[realmroot]

Summary

• match approved Agent authority against standard OpenAPI OAuth 2.0 requirements
• keep Realmroot Agent requests bound to the DPoP auth handler
• reject the obsolete oauth2-dpop inspection kind instead of preserving compatibility
• update the CLI behavior specification and regression coverage

Verification

• make verify
• go vet ./...
• go test -race ./...
• production Realmroot validation: list Applications, create and read a temporary public SPA, delete it, then confirm not_found

---

_{🤖 Created by Jarvis via Realmroot}