oauth: add custom-app U2M OAuth with PKCE

[andy-xu-db]

What this does

Adds src/ucode/oauth.py: the OAuth flow ucode needs to sign in through a custom Databricks OAuth app instead of the built-in databricks-cli one.

Why: the built-in app's refresh token expires after 7 days. A custom app integration can go to 90, but no part of the Databricks CLI lets you select a client id.

• U2M authorization_code + PKCE S256 (the only challenge method Databricks accepts) against /oidc/v1/{authorize,token}, or /oidc/accounts/<id>/v1/... for account-level apps.
• Public client, so no secret anywhere. Scopes all-apis offline_access — the latter is what makes a refresh token come back.
• Own 0600 cache keyed by (host, client id). ~/.databricks/token-cache.json records no client id, so a custom-app refresh token would be refreshed with the built-in client and rejected.

Nothing calls it yet; #517 wires it in. Jira: AIGTWY-4550

Testing

uv run pytest 2,290 passed (+41 vs origin/main, same 21 pre-existing failures); ruff check, ruff format --check, ty check src/ clean. New tests/test_oauth.py covers PKCE, both OIDC shapes, exchange, refresh, cache, expiry buffer, error hints.

🥞 Stacked PR

• stack/oauth-pkce-module [Files changed] ← this PR
  • stack/oauth-auth-token-flag [Files changed]
    • stack/oauth-configure-client-id [Files changed]

---

This pull request and its description were written by Isaac.