Register the estate dashboard as an OIDC client

[ExtraToast]

Parent

JorisJonkers-dev/deploy-kit#195

What to build

A code-registered client for JorisJonkers-dev/estate-dashboard: authorization code with PKCE, the dashboard's redirect URI, refresh tokens, and the admin role in the token. Its secret is in the Secret Store.

Acceptance criteria

• An integration test runs the authorization-code flow for the new client and sees the role claim.

Blocked by

None (can start immediately).