feat(oauth): add Openference OAuth and API key provider integration

[AnhLead]

Summary

• Adds Openference as a first-party OAuth provider (PKCE on loopback 127.0.0.1:56123, rotating oar_* refresh tokens, ES256 JWT bearer auth on api.openference.com/v1/*).
• Adds Openference API (openference-api / ofa) as an API-key catalog entry on the same gateway.
• Wires live /v1/models discovery, OAuth Test Connection (402 = authenticated), free-tier badges, logo, and regression tests.

Provider surface

Entry	ID	Auth
OAuth	openference (of)	PKCE OAuth (omniroute client)
API Key	openference-api (ofa)	Bearer sk-…

Upstream: https://openference.com (AS) · https://api.openference.com/v1 (API)

Test plan

• node --import tsx/esm --test tests/unit/openference-oauth-provider.test.ts
• node --import tsx/esm --test tests/unit/openference-apikey-provider-registration.test.ts
• node --import tsx/esm --test tests/unit/oauth-providers-config.test.ts
• npm run check:provider-consistency

⚠️ base-red inherited: #9679

[AnhLead]

@diegosouzapw Please review and check. Tested and working.

[diegosouzapw]

Thanks for the PR. Please address the mandatory items (tests and/or merge blockers) in this branch, then rerun checks before /merge-prs.

[diegosouzapw]

Thanks for the PR. Please address the mandatory items (tests and/or merge blockers) in this branch, then rerun checks before /merge-prs.

[diegosouzapw]

Thanks for the PR. Please address the mandatory items (tests and/or merge blockers) in this branch, then rerun checks before /merge-prs.

[AnhLead]

@Mergifyio queue

[mergify]

queue

☑️ Command disallowed due to command restrictions in the Mergify configuration.

Details

• sender-permission >= write

[diegosouzapw]

Obrigado pelo PR. Mantive a revisão de fix-in-place e não foi possível concluir o ajuste completo aqui:

• Para os PRs em fork: não consigo aplicar push de correção diretamente na sua branch.
  Por favor, faça um rebase/sync com release/v3.8.50, resolva conflitos se houver, e rode os checks dessa branch.
  Se preferir, posso aplicar a correção na próxima rodada assim que você mandar o branch atualizado ou confirmar que o PR está limpo pra esse merge.

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #8875. Mergify cannot evaluate rules on this PR. Once #8875 is merged or closed, Mergify will resume processing this PR. ⚠️