#3465 chore: drop OAuth proxy provider code

All servers are now migrated off of the legacy oauth proxy. There are two servers (cents Sentry and Fermat MCP) that still have some session refreshing against the old token endpont. This PR adds a graceful 400 to force re-authentication for those two servers. Otherwise, there is no residual traffic in Datadog and all servers have been migrated to user session issuer configuration.

What

Removes the legacy OAuth proxy provider system now that toolsets migrate to user session issuers. external_oauth_server_metadata is untouched. The oauth_proxy_* tables + toolsets.oauth_proxy_server_id column are left for a later data-drop PR (Phase 3).

Commits

Server (removal):

• refactor(oauth): remove the OAuth proxy serving path
• refactor(oauth): remove the oauth/providers package
• refactor: remove OAuth proxy management endpoints and migration enablement
• chore(gen): regenerate artifacts
• refactor(cache): drop AdditionalCacheKeys from CacheableObject
• refactor(audit): stop emitting OAuth proxy audit events (action constants kept for historical entries)

Dashboard (rewire):

• chore(gen): regenerate SDK
• fix(dashboard): adopt renamed TokenEndpointAuthMethod SDK enum
• refactor(dashboard): create user session issuers from the OAuth config flow — the Configure-OAuth wizard keeps its structure but its custom path now provisions a user_session_issuer + remote_session_issuer + remote_session_client and links the toolset (replacing the removed proxy creation); external-OAuth path unchanged; migrate-from-proxy + Platform/Edit proxy modals removed; feature gate dropped.

Testing

• Server: build:server, lint:server clean; test:server ./internal/... = 5,138 passing.
• Dashboard: type-check + full lint clean; pnpm -F dashboard test = 504/505 (the 1 failure is a pre-existing, unrelated workspace-switcher mock issue); oauth-wizard suite 59/59.

🤖 Generated with Claude Code