Expand security-focused integration coverage #1730

Goal

Add regression tests for the security boundaries identified in the service review.

Coverage

• Management endpoint authentication and authorization.
• Redirect URI and open-redirect attempts.
• Unsupported OAuth grant types.
• Token key persistence and rotation.
• Client-registration rollback.
• Password/email secret leakage.
• Rate limiting and refresh-token reuse.

Acceptance criteria

Each scenario has an integration test that fails for the relevant security regression rather than only asserting a generic error response.