Make OAuth metadata discoverable from the API origin
Agents probing the API origin's root OAuth discovery URL currently receive 404 even though Recoup publishes valid metadata for its /api/oauth issuer. Add a public, uncached 308 alias to that authoritative RFC 8414 document, preserving the existing issuer, scopes, consent and token behavior. Disabled OAuth stays 404; invalid configuration returns a bounded 503.
Validation: 210 OAuth tests pass (one optional PostgreSQL integration test skipped), OAuth TypeScript check and repository-wide ESLint pass. Seven new tests cover the alias, disabled state, malformed issuer configuration and CORS preflight. Production verification follows merge.
Summary by cubic
Makes the API origin's root OAuth discovery URL reachable so clients probing /.well-known/oauth-authorization-server no longer get a 404.
That URL now returns an uncached 308 redirect to the existing RFC 8414 metadata document for the configured path-based issuer, leaving token issuance, scopes, and consent untouched. Disabled OAuth returns 404 for both GET and OPTIONS, and a misconfigured issuer logs the error and returns a bounded 503. Seven new tests cover the redirect, disabled state, invalid issuer configurations, and CORS preflight.