Add OAuth 2.0 + PKCE support for GPT Actions with unified API surface

[Copilot]

This PR adds an OAuth 2.0 Authorization Code flow with PKCE for GPT Actions, without changing the existing JWT-based user auth or the separate Google Drive OAuth integration. GPT tokens authenticate against the existing /api/v1/** endpoints directly — no duplicate controller layer.

• OAuth flow for GPT Actions

  • adds /oauth2/authorize and /oauth2/token for a dedicated GPT client
  • validates configured client ID/secret, allowed redirect URIs, requested scopes, and PKCE S256
  • persists short-lived authorization codes server-side and exchanges them for signed bearer tokens

• Unified security model

  • GptOAuthSecurityConfig chain scoped to /oauth2/** only; OAuth endpoints are public
  • JwtAuthenticationFilter extended to try GPT OAuth tokens as a fallback after user JWT validation, keeping both auth modes in the same chain without BearerTokenAuthenticationFilter conflicts
  • GPT tokens carry ROLE_GPT_CLIENT (not ROLE_USER) plus any non-USER roles (e.g. ROLE_BETA), making scope checks meaningful
  • JwtAuthenticationToken subject resolves to the user email so SecurityUtils and repository-level user isolation continue to work unchanged

• One API surface, two authentication modes

  • GPT tokens access the existing endpoints directly — no /api/v1/gpt/** duplicate layer
  • AuthController#me, ApplicationController#{create,getAll,getById,updateStatus} annotated with @PreAuthorize("hasRole('USER') or hasAuthority('SCOPE_...')")
  • Google Drive endpoints accessible to GPT require hasRole('BETA') and (hasRole('USER') or hasAuthority('SCOPE_...')); all other Google Drive endpoints remain USER-only at URL level
  • URL-level hasAnyRole("USER","GPT_CLIENT") guards in SecurityConfig for each GPT-accessible path; hasRole("USER") catch-all covers everything else

• Config and docs

  • adds env-driven GPT OAuth configuration:
    • OPENAI_GPT_CLIENT_ID
    • OPENAI_GPT_CLIENT_SECRET
    • OPENAI_GPT_REDIRECT_URIS
    • OPENAI_GPT_SCOPES
  • updates OpenAPI with an OAuth2 authorization-code security scheme; gpt-actions group lists the real existing endpoint paths instead of a parallel controller section
  • documents GPT Action setup and the new auth flow in README.md
  • updates application.yml, application-test.yml, and .env.example

• Persistence and regression coverage

  • adds a migration for GPT authorization-code storage
  • adds tests for config loading, code exchange/token issuance, scope-based access to the existing endpoints, OpenAPI exposure, JWT regression, and Google Drive regression

Example GPT flow:

GET /oauth2/authorize?response_type=code&client_id=...&redirect_uri=...&scope=read:profile%20read:applications&code_challenge=...&code_challenge_method=S256
POST /oauth2/token
Authorization: Basic <client credentials>

GET /api/v1/auth/me
Authorization: ******

POST /api/v1/applications
Authorization: ******

Endpoint-level authorization on the existing controllers:

@PreAuthorize("hasRole('USER') or hasAuthority('SCOPE_write:applications')")
@PostMapping
public ResponseEntity<ApplicationResponse> create(@Valid @RequestBody ApplicationRequest request) {
    return ResponseEntity.status(HttpStatus.CREATED).body(applicationService.create(request));
}