Stale operator-declared OAuth clients are never removed from durable storage

[jhrozek]

Summary

Operator-declared (configured) OAuth clients — delegate clients today, and static SPIFFE clients as of #6474 — are registered/reconciled into durable storage at server startup, but nothing ever removes a client's durable record when it is later dropped from RunConfig. The record (and, for SPIFFE, the durable client-ID claim added in #6474 to close a rolling-deployment race) persists forever until an operator manually deletes it from the storage backend.

This is pre-existing behavior for delegate clients (registerDelegateClients in pkg/authserver/server_impl.go only ever creates/reconciles, never deletes) and was inherited, not introduced, by the SPIFFE static-client work.

Impact

• Redis: a stale record survives indefinitely (no TTL) since it's operator-declared and therefore exempt from the DCR-issued eviction/TTL path.
• In-memory: not affected across restarts (state is ephemeral), but persists for the lifetime of a running process even after a config reload that would otherwise remove the association.
• A previously-configured client ID stays permanently reserved/unusable for DCR (SPIFFE case) or keeps its old secret/scopes/grants live (delegate-client case) even after the operator believes they removed it.

Possible approach

• Persist a marker distinguishing "configured/reconciled" rows (needed for other reasons too — see Register and harden static SPIFFE clients #6474 review).
• Add a startup (or periodic) reconciliation step that diffs currently-claimed configured client IDs against the current RunConfig and removes ones no longer configured, scoped per storage backend (Redis: SCAN over the client keyspace filtered to the marker; in-memory: iterate the map).
• Needs care around blast radius/perf on SCAN at production scale, and around not deleting anything for an in-flight config validation error (only reconcile after successful validation).

References

• pkg/authserver/server_impl.go (registerDelegateClients)
• pkg/authserver/storage/spiffe_decorator.go (preflightDurableCollisions, added in Register and harden static SPIFFE clients #6474)
• pkg/authserver/storage/{memory,redis}.go (RegisterClient/ReconcileConfiguredClient)
• Discussed in PR Register and harden static SPIFFE clients #6474 review (JAORMX finding fix(typo): corrects readme #1) and its follow-up fix