Add device-grant dev sign-in (CRD-driven) for local/agent development

AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/auth/oidc_test.go

@@ -103,6 +103,25 @@ func TestVerifyToken(t *testing.T) {
 		t.Fatalf("expected wrong audience to fail")
 	}
 
+	// Extra audience: rejected unless configured, accepted once it is.
+	urlAudToken := mintToken("key-1", IDClaims{
+		Iss: "https://test.issuer",
+		Sub: "dev-user",
+		Aud: Audience{"dev-console", "https://svc.example"},
+		Exp: time.Now().Add(time.Hour).Unix(),
+	})
+	if _, err := auth.VerifyToken(context.Background(), urlAudToken); err == nil {
+		t.Fatalf("expected unconfigured extra audience to fail")
+	}
+	auth.audience = "https://svc.example"
+	if _, err := auth.VerifyToken(context.Background(), urlAudToken); err != nil {
+		t.Fatalf("expected configured audience to pass, got: %v", err)
+	}
+	if _, err := auth.VerifyToken(context.Background(), wrongAudToken); err == nil {
+		t.Fatalf("configured audience must not admit other audiences")
+	}
+	auth.audience = ""
+
 	// Wrong issuer
 	wrongIssToken := mintToken("key-1", IDClaims{
 		Iss: "https://wrong.issuer",