Add an OAuth2/OIDC provider + application for the repospawner operator tool, fronted by oauth2-proxy, and gate it on a new akP-repospawner-admin permission group nested under akR-global-admin (mirrors the watchstate precedent).
