fix vault OIDC client_id injection

[travisbcotton]

Description

The operator's EnsureOIDCConfig only configures identity/oidc/config (issuer) and identity/oidc/key/openchami-<cluster> — but never creates the OIDC client (identity/oidc/client/...). Because no Vault OIDC client exists

• No client_id was ever generated.
• The KV path openchami/<cluster>/oidc/tokensmith-client was seeded with only a random client_secret (internal/reconcilers/vault.go:238) — a bogus value, not a real Vault-issued credential.
• The tokensmith Deployment only injected OIDC_CLIENT_SECRET, never OIDC_CLIENT_ID (internal/reconcilers/tokensmith.go:250).

So the client_secret in the k8s secret was just randomHex(32), and client_id was entirely absent — JWT validation had no way to succeed.

Fixes

1. internal/vault/client_vault.go — EnsureOIDCConfig now creates the identity/oidc/client/openchami-<cluster>-tokensmith (using the built-in allow_all assignment), reads it back, and returns the Vault-generated client_id/client_secret. Signature changed to return a new OIDCClientCredentials struct.

2. internal/vault/client.go — interface updated + OIDCClientCredentials type added.

3. internal/reconcilers/vault.go — when oidcProvider: vault, the returned credentials are written (overwrite) into the TokensmithOIDC KV path, so VSO syncs a real client_id and client_secret into openchami-<cluster>-tokensmith-oidc. The seed now also includes a client_id placeholder (matters for the external provider).

4. internal/reconcilers/tokensmith.go — added the OIDC_CLIENT_ID env var sourced from the secret's client_id key (alongside the existing OIDC_CLIENT_SECRET).

5. internal/vault/fake/client.go & tests — fake returns stable per-cluster creds; added regression test TestVaultReconciler_OIDCClientCredentials and extended the tokensmith test to assert OIDC_CLIENT_ID.

6. hack/local-dev/seed-vault.sh — now seeds client_id too.

Fixes #38

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.