[enterprise-auth S16] Define outbound NetScript-as-IdP support

[rickylabs]

Part of #871

Track the deliberately deferred “being the IdP” capability separately from
inbound enterprise SSO. Evaluate WorkOS Connect and Better Auth OAuth 2.1
Provider as carriers for authorization-server behavior, including OAuth/OIDC
discovery, client registration, consent, authorization code/PKCE, client
credentials, token/introspection/revocation, signing-key rotation, resource
indicators, and MCP protected-resource integration. NetScript should normalize
configuration and policy, not implement another authorization server.

Acceptance

• gate: RFC/threat model separates authorization-server, resource-server, inbound-SSO, and application-session trust boundaries
• gate: WorkOS Connect and Better Auth OAuth 2.1 Provider are compared for deployment, protocol, tenant, key, consent, client-registration, token, revocation, and MCP requirements
• gate: issuer, audience/resource, client, scope, grant, consent, organization, actor, and signing-key contracts are vendor-neutral and versioned
• gate: authorization code uses PKCE and mix-up defenses; machine grants, dynamic registration, refresh, introspection, and revocation have explicit enablement and policy
• gate: signing keys and client credentials use EA-08 secret/rotation contracts and all issuance/consent/admin activity uses EA-06 audit events
• gate: no inbound SSO issue implicitly promises NetScript-as-IdP before this child is implemented and conformance-tested
• gate: generated examples prove one browser client, one machine client, and one MCP protected resource without embedding secrets

Metadata

• Dependencies: EA-08, EA-10, EA-12, EA-13, and EA-14.
• Delivery shape: backlog-grade RFC and vendor-adapter comparison first; no custom authorization-server implementation.