OIDC trust API

Trust-rule CRUD needs API_OIDC_TRUST and ALL_REPO. Exchange needs no Amendable token.

GET /v1/oidc-trust-rules/setup

Audience, token URL, GitHub/GitLab presets, GitHub Actions snippet.

POST /v1/oidc-trust-rules

{
  "name": "gha",
  "issuer": "https://token.actions.githubusercontent.com",
  "audience": "amendable:USER_UUID",
  "subject": "repo:ORG/REPO:ref:refs/heads/main",
  "claim_matchers": {},
  "scope": "ALL_REPO",
  "grants": ["GIT_HTTP_READ", "GIT_HTTP_WRITE"],
  "enabled": true
}

GET / PUT / DELETE /v1/oidc-trust-rules/{id}

POST /v1/oidc/token

{ "id_token": "<jwt>" }

200:

{
  "token": "...",
  "token_type": "access-token",
  "expires_at": "2026-08-23T01:30:00+00:00"
}

401 { "detail": "Invalid ID token" } on any verification failure.