Splits the monolithic oauth.zig into oauth/primitives.zig (PKCE, DPoP, client assertions, form/JWKS) and oauth/client.zig (framework-neutral ATProto OAuth ceremony: discovery, PAR, code/refresh exchange, DPoP nonce retry, DPoP-authenticated requests). HttpTransport.FetchResult gains OAuth-relevant response headers and a deinit helper so clients stay on the shared transport path. This is the work the 0.3.6 changelog describes but that never made it into the v0.3.6 tag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>