Add user-level access gating to OIDC clients and Legacy HMAC apps, matching the existing forward-auth proxy access control pattern. - New `client_access_rules` table for per-client allow/deny rules - New `require_access_check` flag on apps table (default: off) - Enforcement in OIDC authorize callback + passkey flow - Enforcement in Legacy HMAC auth callback - Admin API: CRUD endpoints + dry-run access check - Generic `checkAccess()` now works with both proxy and client rules - 19 new tests (423 total, all passing) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>