Upgrade oauth2 to v5.0 with typestate endpoint safety

[Copilot]

Upgrades oauth2 from 4.4 to 5.0, adopting the new typestate-based API that enforces endpoint configuration at compile time.

Dependency Updates

• oauth2: 4.4 → 5.0
• reqwest: 0.11 → 0.12 (required by oauth2 v5)

OAuth Client Refactor

• Single-argument constructor with explicit endpoint setters replacing the old multi-argument new()
• Typestate generics track configured endpoints at compile time
• Type alias ConfiguredClient documents the endpoint configuration

// Before (v4.4)
BasicClient::new(
    client_id,
    Some(client_secret),
    auth_url,
    Some(token_url),
)

// After (v5.0)
BasicClient::new(client_id)
    .set_client_secret(client_secret)
    .set_auth_uri(auth_url)
    .set_token_uri(token_url)

HTTP Client Security

• Stateful reqwest::Client replaces function-based client
• Explicit redirect::Policy::none() for SSRF protection

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.