Real feature/oauthkey resolver via tsnet: tskey-client- secret, ?baseURL attributes, CreateKey, register re-advertising key tags.
Add scope-enforcement coverage and integration tests for the oauth-clients CLI across the test matrix.