feat: add OAuth credential support to add identity and outbound auth CLI flags

[aidandaly24]

Description

Users need to configure outbound authentication when connecting gateway targets to external MCP servers that require credentials. Previously, the only way to create credentials was API keys through add identity, and there was no way to specify outbound auth when creating gateway targets via CLI flags.

This PR adds two things:

OAuth credential support in add identity. createCredential now handles both API keys and OAuth credentials. For OAuth, it writes the OAuthCredentialProvider config to agentcore.json and stores CLIENT_ID/CLIENT_SECRET in .env.local. Users can now run:

agentcore add identity --name my-oauth --type oauth \
 --discovery-url https://auth.example.com/.well-known/openid-configuration \
 --client-id abc123 --client-secret xyz789

Outbound auth CLI flags on add gateway-target. Users can reference an existing credential or create one inline:

# Reference existing credential
agentcore add gateway-target --outbound-auth oauth --credential-name my-oauth ...

# Create credential inline (auto-generates credential named {target}-oauth)
agentcore add gateway-target --outbound-auth oauth \
 --oauth-client-id abc --oauth-client-secret xyz \
 --oauth-discovery-url https://auth.example.com ...

Validation rejects conflicting configurations (e.g. --outbound-auth api-key with inline OAuth fields) and ensures all required fields are present for each auth type.

This is the operations + CLI layer only. The interactive TUI wizard for outbound auth selection is a follow-up PR.

Related Issue

Part of the MCP Gateway Phase 1 integration (gateway-integration branch). Task 12a.

Type of Change

• New feature

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

15 new tests covering:

• OAuth credential creation (writes correct config + env vars, handles duplicates, includes scopes)
• Identity validation (OAuth requires discovery-url, client-id, client-secret)
• Gateway target outbound auth validation (inline OAuth, incomplete fields, API_KEY conflicts, missing credential-name)

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published