✨ feat(auth): pkg/auth skeleton for OpenID Connect (ADR-0028 Phase B prep)

Add pkg/auth package with OIDCClient skeleton:
- oidc.go: OIDCClient struct with discovery/JWKS caching, NewOIDCClient constructor
- Discovery, TokenResponse, IDTokenClaims types
- TODO skeleton methods: Discover, RefreshJWKS, ExchangeCode, ValidateIDToken
- oidc_test.go: smoke test for NewOIDCClient

All methods are TODO placeholders for Phase B.3 implementation.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

pkg/auth/oidc_test.go

@@ -0,0 +1,13 @@
+package auth
+
+import "testing"
+
+func TestNewOIDCClient(t *testing.T) {
+	c := NewOIDCClient("https://example.com", "client_id", "client_secret")
+	if c == nil {
+		t.Fatal("NewOIDCClient returned nil")
+	}
+	if c.issuerURL != "https://example.com" {
+		t.Errorf("issuerURL not set: got %q", c.issuerURL)
+	}
+}