feat(codemode): scope OpenAPI OAuth by caller

[jmagar]

Summary

• add oauth_upstream to Code Mode OpenAPI specs for caller-subject-scoped OAuth
• resolve bearer tokens at dispatch time from the authenticated caller subject using the existing upstream OAuth store and refresh path
• keep static credentials admin/trusted-local only and fail closed for missing subject, scoped routes, conflicting auth, and missing caller credentials
• update canonical Code Mode, OAuth, runtime config, and crate docs

Security properties

• user tokens never enter the OpenAPI registry or JavaScript sandbox
• no fallback from a user subject to another subject or shared operator credential
• subject-scoped operations require an authenticated unscoped executor
• lower-level OpenAPI dispatch rejects subject-scoped calls without an injected caller credential

Verification

• cargo test -p labby-openapi: 29 passed; 1 network smoke intentionally ignored
• subject-scoped Code Mode authorization regression: passed
• OpenAPI OAuth config regressions: 3 passed
• strict Clippy on affected crates/all features/all targets with -D warnings: passed
• cargo fmt --all -- --check and git diff --check: passed
• just docs-check: 17 generated artifacts fresh, 611 links verified, 125 canonical docs validated, 5 contract tests passed

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.