OAuth2 fixture

OAuth2Fixture exposes a token endpoint backed by the same deterministic fixture server as the rest of the suite.

It counts token requests, which is what makes design §20.3's single-flight guarantee provable rather than assumed: a hundred genuinely concurrent callers must produce exactly one token request. It can also issue rotating token values, so a stale cached token is detectable, and queue a failure status to exercise the refresh-failure path.

The token endpoint is configured as its own Named Client Profile, separate from the upstream it issues tokens for.