Add device-grant dev sign-in (CRD-driven) for local/agent development

AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/auth/oidc.go

@@ -78,6 +78,10 @@ type OidcAuth struct {
 	disabled   bool
 	ingestKey  string
 	agentToken string
+	// audience is an optional extra accepted token audience: this service's
+	// own URL, which the issuer emits via AuthClient.spec.audience (e.g. for
+	// device-grant dev tokens minted for another client).
+	audience string
 
 	mu      sync.Mutex
 	keys    map[string]*rsa.PublicKey
@@ -102,6 +106,7 @@ func NewOidcAuth(ingestKey string) *OidcAuth {
 		disabled:   disabled,
 		ingestKey:  ingestKey,
 		agentToken: os.Getenv("OTEL_AGENT_TOKEN"),
+		audience:   os.Getenv("OTEL_OIDC_AUDIENCE"),
 	}
 }
 
@@ -239,7 +244,7 @@ func (a *OidcAuth) VerifyToken(ctx context.Context, token string) (*IDClaims, er
 	if claims.Iss != a.issuer {
 		return nil, fmt.Errorf("unexpected issuer %q", claims.Iss)
 	}
-	if !claims.Aud.Contains(a.client) {
+	if !claims.Aud.Contains(a.client) && (a.audience == "" || !claims.Aud.Contains(a.audience)) {
 		return nil, errors.New("token not issued for this client")
 	}
 	if claims.Exp != 0 && time.Now().Unix() > claims.Exp {

internal/auth/oidc_test.go

@@ -103,6 +103,25 @@ func TestVerifyToken(t *testing.T) {
 		t.Fatalf("expected wrong audience to fail")
 	}
 
+	// Extra audience: rejected unless configured, accepted once it is.
+	urlAudToken := mintToken("key-1", IDClaims{
+		Iss: "https://test.issuer",
+		Sub: "dev-user",
+		Aud: Audience{"dev-console", "https://svc.example"},
+		Exp: time.Now().Add(time.Hour).Unix(),
+	})
+	if _, err := auth.VerifyToken(context.Background(), urlAudToken); err == nil {
+		t.Fatalf("expected unconfigured extra audience to fail")
+	}
+	auth.audience = "https://svc.example"
+	if _, err := auth.VerifyToken(context.Background(), urlAudToken); err != nil {
+		t.Fatalf("expected configured audience to pass, got: %v", err)
+	}
+	if _, err := auth.VerifyToken(context.Background(), wrongAudToken); err == nil {
+		t.Fatalf("configured audience must not admit other audiences")
+	}
+	auth.audience = ""
+
 	// Wrong issuer
 	wrongIssToken := mintToken("key-1", IDClaims{
 		Iss: "https://wrong.issuer",