Add device-grant dev sign-in (CRD-driven) for local/agent development

AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/auth/oidc.go

@@ -78,6 +78,10 @@ type OidcAuth struct {
 	disabled   bool
 	ingestKey  string
 	agentToken string
+	// audience is an optional extra accepted token audience: this service's
+	// own URL, which the issuer emits via AuthClient.spec.audience (e.g. for
+	// device-grant dev tokens minted for another client).
+	audience string
 
 	mu      sync.Mutex
 	keys    map[string]*rsa.PublicKey
@@ -102,6 +106,7 @@ func NewOidcAuth(ingestKey string) *OidcAuth {
 		disabled:   disabled,
 		ingestKey:  ingestKey,
 		agentToken: os.Getenv("OTEL_AGENT_TOKEN"),
+		audience:   os.Getenv("OTEL_OIDC_AUDIENCE"),
 	}
 }
 
@@ -239,7 +244,7 @@ func (a *OidcAuth) VerifyToken(ctx context.Context, token string) (*IDClaims, er
 	if claims.Iss != a.issuer {
 		return nil, fmt.Errorf("unexpected issuer %q", claims.Iss)
 	}
-	if !claims.Aud.Contains(a.client) {
+	if !claims.Aud.Contains(a.client) && (a.audience == "" || !claims.Aud.Contains(a.audience)) {
 		return nil, errors.New("token not issued for this client")
 	}
 	if claims.Exp != 0 && time.Now().Unix() > claims.Exp {