Persist OAuth state across restarts

[welearner]

Summary

This PR persists OAuth clients and refresh tokens to disk so OAuth sessions can survive DevSpace server restarts.

Access tokens and authorization codes remain in memory only.

Motivation

DevSpace currently stores OAuth state in memory. When the server restarts, registered OAuth clients and refresh tokens are lost, requiring clients to repeat the OAuth registration and authorization flow.

Persisting clients and refresh tokens allows clients to recover after a restart using the standard OAuth refresh flow.

Changes

• Persist registered OAuth clients.
• Persist refresh tokens as token hashes.
• Restore non-expired refresh tokens on startup.
• Keep access tokens in memory only.
• Keep authorization codes in memory only.
• Add DEVSPACE_OAUTH_STATE_PATH configuration.
• Default OAuth state path to <DEVSPACE_STATE_DIR>/oauth.json.
• Add tests for OAuth state persistence and refresh-token recovery after restart.

Security notes

• Raw token values are not written to disk.
• Refresh tokens are stored as hashes.
• Expired refresh tokens are ignored when loading state.
• Access tokens are intentionally not persisted because they are short-lived bearer credentials.

Testing

• npm test
• npm run typecheck