Add schemas for OAuth entities

[apata]

Changes

Adds schemas for OAuth entities. Based on the requirements in https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/15/.

Definitions for Plausible MCP use case

• Protected Resource: User's sites and stats via /mcp endpoint on Plausible app server
• Resource Owner: user of Plausible
• Client: browser launched by Claude Code
• Authorization Server: Plausible app server
• Resource Server: Plausible app server

        +--------+                               +---------------+
        |        |--(1)- Authorization Request ->|   Resource    |
        |        |                               |     Owner     |
        |        |<-(2)-- Authorization Grant ---|               |
        |        |                               +---------------+
        |        |
        |        |                               +---------------+
        |        |--(3)-- Authorization Grant -->| Authorization |
        | Client |                               |     Server    |
        |        |<-(4)----- Access Token -------|               |
        |        |                               +---------------+
        |        |
        |        |                               +---------------+
        |        |--(5)----- Access Token ------>|    Resource   |
        |        |                               |     Server    |
        |        |<-(6)--- Protected Resource ---|               |
        +--------+                               +---------------+

                      Figure 1: Abstract Protocol Flow

  +--------+                                           +---------------+
  |        |--(1)------- Authorization Grant --------->|               |
  |        |                                           |               |
  |        |<-(2)----------- Access Token -------------|               |
  |        |               & Refresh Token             |               |
  |        |                                           |               |
  |        |                            +----------+   |               |
  |        |--(3)---- Access Token ---->|          |   |               |
  |        |                            |          |   |               |
  |        |<-(4)- Protected Resource --| Resource |   | Authorization |
  | Client |                            |  Server  |   |     Server    |
  |        |--(5)---- Access Token ---->|          |   |               |
  |        |                            |          |   |               |
  |        |<-(6)- Invalid Token Error -|          |   |               |
  |        |                            +----------+   |               |
  |        |                                           |               |
  |        |--(7)----------- Refresh Token ----------->|               |
  |        |                                           |               |
  |        |<-(8)----------- Access Token -------------|               |
  +--------+           & Optional Refresh Token        +---------------+

               Figure 2: Refreshing an Expired Access Token

Tests

• This PR does not require tests

Changelog

• This PR does not make a user-facing change

Documentation

• This change does not need a documentation update

Dark mode

• This PR does not change the UI