e2e characterization tests for /oauth2 #1221

Part of #1075, the plan step "e2e characterization tests for /oauth2".

Problem

Before /oauth2 leaves Restlet, its HTTP contract has to be pinned by tests that run against master.
The plan moves the whole /oauth2/* to the OpenAM CHF servlet behind a Restlet fallback, then
migrates one endpoint family per PR. Each of those PRs proves parity with these tests.

OAuth2RouterProvider attaches 18 Restlet routes under /oauth2: authorize, access_token,
tokeninfo, introspect, connect/register, userinfo, idtokeninfo, connect/checkSession,
connect/endSession, connect/jwk_uri, resource_set (x3), .well-known/openid-configuration,
device/user, device/code, token/revoke and the realm route. Master's e2e covers few of them,
in 14 tests:

• e2e/oauth2/oauth2-test.spec.mjs, 5 tests: the authorization code grant, userinfo (OAuth2 IDP E2E smoke test #1025), and
  three consent CSRF tests (OAuth2 Consent CSRF changes break documented POST consent flow #1080);
• e2e/oauth2/device-flow-test.spec.mjs, 9 tests: the device flow (GHSA-545c).

The never-merged features/restlet-migration branch of the maximthomas/OpenAM fork (tip
b02024a4f0) has five /oauth2 specs with 121 tests:

• Three specs (100 tests) were recorded against the branch's Restlet code before bccbc9c4d9 moved
  /oauth2 to CHF. That commit also rewrote them toward CHF, so they are taken at bccbc9c4d9^.
  At the tip, oauth2-test.spec.mjs does not even load: a merge left two const CONSENT_CLIENT_ID
  declarations.
• realms-test.spec.mjs and display-test.spec.mjs (21 tests) were written after the flip, against
  CHF.

Scope

Port these specs from the branch:

Fixtures: #1211 took from e2e/common/oauth2-fixtures.mjs only what the /uma spec needs.

• Missing exports: authorizationCodeTokens, CLIENT_SESSION_URI, deleteClient,
  deviceCodeForConsent, ensureDeviceConsentClient, ensureNoSessionUriOidcClient,
  ensureOidcClient, OIDC_CLIENT_SECRET, pkce, POST_LOGOUT_REDIRECT_URI,
  POST_LOGOUT_REDIRECT_URI_WITH_QUERY, sessionContext.
• Shared members differ too. On the branch, REQUIRED_SCOPES adds openid and profile, and
  ensureOAuth2Provider sets codeVerifierEnforced: true, but only when it creates the provider.
  On master, oauth2-test and device-flow-test configure the provider with their own helpers, and
  Playwright runs spec files in parallel. The settings the specs need must hold whichever spec runs
  first, or the specs must not depend on them.

Also:

• All 14 master tests stay.
• Tests only: no production change and no workflow change. build-docker already runs every spec
  under e2e/.
• The step may split into several PRs when it is planned.

How the ported tests change

The specs pin what master answers today, on Restlet:

• The values were recorded on the branch, on top of master 32f2b9572d (2026-07-24). They can differ
  from master for two reasons. The branch had refactored OAuth2Request and other classes behind
  /oauth2 before the flip. Master has also changed /oauth2 since then, among others in GHSA-v6hq,
  GHSA-h93p, GHSA-545c, GHSA-g7cv, GHSA-3m32, GHSA-6f8c, GHSA-5p2f, OAuth2 Consent CSRF changes break documented POST consent flow #1080, Fix Device Code session propagation and OIDC claims #1108, NPE and wrong-attribute dispatch in OAuth2 client-authentication paths (id_token_signed_response_alg) #1130, OAuth 2.0 device flow: an expired device code can still be approved and redeemed #1143 and
  OIDC discovery advertises revocation_endpoint at /oauth2/revoke, but token revocation is routed at /oauth2/token/revoke #1195. Where a ported test disagrees with master, it follows master.
• A value that is a framework artefact is reduced to the status, in every ported test. Examples:
  Server: Restlet-Framework/2.4.4, and the bodies of unrouted 404 and 405 answers. The pre-flip
  specs pin such values byte for byte. Those artefacts get one upgrade note at the end of Remove Restlet: migrate /oauth2, /uma, /xacml and /.well-known to the ForgeRock CHF stack #1075.
• Where master's behaviour is a defect against the target contract, the test pins master's value
  and a comment names the target value. No test.fail(), no dropped test. This also applies to
  defects the ported specs already pin, for example the 500 for an unknown Host. Known case: the
  401 from /oauth2/resource_set carries no WWW-Authenticate. The target is
  WWW-Authenticate: Bearer (RFC 6750 §3), as for /uma in [#1075] e2e characterization tests for /uma and WebFinger #1211. The branch specs do not assert
  this header yet.
• The PR description lists every ported test whose expectation changed, with the reason.

The branch has the live-Restlet captures of its pre-flip run, at b02024a4f0:
docs/migration/restlet/artefacts/e2e-transcript-pre-flip.txt and e2e-oracle-pre-flip.txt. They
help to tell branch refactoring from master changes.

Out of scope

• The next plan step, the gap fill:
  • e2e for the security fixes that are tested only through Restlet classes (GHSA-v6hq, GHSA-3m32,
    GHSA-6f8c, GHSA-h93p, OAuth 2.0 device flow: an expired device code can still be approved and redeemed #1143);
  • client_secret_post and private_key_jwt;
  • the response_mode, prompt, acr_values and claims parameters;
  • introspect/token/revoke/userinfo variants;
  • non-root realms beyond realms-test.spec.mjs.
• /uma and WebFinger, which [#1075] e2e characterization tests for /uma and WebFinger #1211 pins, and /xacml, already on CHF ([#1075] Serve /xacml through CHF and delete its Restlet code #1214).

Done when

• The five specs are on master, with what they import from oauth2-fixtures.mjs and the provider
  settings they need. The 14 tests of oauth2-test.spec.mjs (5) and device-flow-test.spec.mjs (9)
  are kept.
• build-docker runs them green against master, with no test.fail().
• Every changed expectation is listed in the PR description.