Hash client secrets and add admin client APIs

[joneja09]

Depends on #2.

Client secrets are no longer stored in plaintext, and you can register clients through an admin API instead of inserting rows by hand.

Secret hashing

• Secrets are hashed with ASP.NET Identity's PasswordHasher
• Token endpoint verifies the hash (plaintext leftovers from an older database are still accepted once, then re-hashed on seed)
• Admin responses never return the stored hash; the plaintext secret is shown only at create/rotate time

Admin API (Administrator role)

Sign in as the seeded admin@localhost user, then:

• GET /admin/clients
• POST /admin/clients — returns the secret once
• PUT /admin/clients/{id}
• POST /admin/clients/{id}/secret — rotate
• DELETE /admin/clients/{id}

JWTs from /account/login/token now include role claims so [Authorize(Roles = "Administrator")] works.

Tests

dotnet test: 12 passed.