feat(server): wire automatic client registration into server.Config

[osanderson]

Summary

• Adds server.Config.AutomaticRegistration (optional — zero value disables it entirely, matching this package's existing "zero disables the feature" precedent) and Dependencies.FederationHTTP.
• When TrustAnchors is set, New transparently wraps Dependencies.Clients/ClientKeys with federation.AutomaticClientRepository/AutomaticClientKeySource (feat(federation): add automatic client registration (OpenID Federation 1.0 §12.1) #259) — every other internal (PAR, the token endpoint, CIBA) keeps calling those same Dependencies fields exactly as before, unaware an automatically-registered Relying Party is now also possible. Statically registered clients always take priority.
• Bug fix found while writing this PR's own end-to-end test: AutomaticClientKeySource treated any error-free result from Underlying as final, including an empty VerificationKeySet — but keys.ClientKeySource legitimately returns an empty, error-free set to mean "no matching key" (the same way server's own fakeClientKeySource test double already behaves for an unknown client), so this silently defeated the federation fallback whenever Underlying had that shape. An empty result now falls through to federation resolution exactly like an error would.

Test plan

• go build ./...
• go test -race ./...
• golangci-lint run ./... — 0 issues
• New tests: Config.AutomaticRegistration validation (empty allowed scopes, zero max cache age, zero max path length, nil FederationHTTP, a malformed TrustAnchors entry), zero-value config leaves the server behaving exactly as before, and — the real proof this actually works — a genuine end-to-end test over real HTTPS test servers where Dependencies.Clients/ClientKeys are both deliberately empty (no static client could ever resolve) and PushAuthorizationRequest still succeeds for a Relying Party authenticated with the key it published in its own federation-resolved openid_relying_party metadata.
• server package coverage: 87.3%; federation package (bug fix): 98.2%

🤖 Generated with Claude Code

https://claude.ai/code/session_017N2kkxv9BR4Qmj8De3Ucs6

[codecov]

Codecov Report

❌ Patch coverage is 86.66667% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
server/server.go	86.20%	2 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud