feat(keycardai-oauth)!: multi-resource web-app flow

[devin-ai-integration]

Summary

The web-app flow could only ever authorize one resource, even though the authorize-URL builder it calls already takes a list and emits repeated RFC 8707 resource parameters. begin_authorization now exposes that list, and complete_authorization stops sending a resource on the token request at all — the server derives the issued token's audience from the authorization code, so the parameter was inert there.

-async def begin_authorization(*, resource_url: str | None = None, ...)
-    resources=[resource_url] if resource_url else None,
+async def begin_authorization(*, resources: list[str] | None = None, ..., resource_url: str | None = None)
+    resources=resources,

 class AuthorizationRedirect(BaseModel):
+    resources: list[str] | None = None   # persist alongside state + verifier

-async def complete_authorization(*, resource_url: str | None = None, ...)
-    await oauth_client.exchange_authorization_code(..., resource=resource_url)
+async def complete_authorization(*, ...)                                    # no resource in any form
+    await oauth_client.exchange_authorization_code(...)

resource_url is removed outright on both calls, no deprecation window: the flow shipped days ago with one known consumer, so the breaking release is the cleanest contract. Passing it raises TypeError.

Two internals follow from dropping the token-request resource: challenge-driven complete_authorization no longer requires any resource to resolve the issuer (it calls the public resolve_issuer_from_challenge directly instead of _resolve_auth_server_url, whose only use of resource_url was a presence check), while challenge-driven begin_authorization keeps that requirement, now phrased in terms of resources. pkce/client.py (the loopback authenticate flow) is untouched.

The sdk-spec change this implements is keycard-sdk-spec#53 (open); merge that first. The spec now specifies the clean break, so no open questions remain.

Link to Devin session: https://app.devin.ai/sessions/7086dca212ec4b24a91c3c1623d4abb7
Open in Devin Desktop: https://app.devin.ai/desktop/session/7086dca212ec4b24a91c3c1623d4abb7?variant=devin
Requested by: @Larry-Osakwe

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring