Stale bot closed the other and will not let me reopen after I force pushed, so here is a new one.

Closes#11084

Stacked manually so I can compare the experience to Graphite. Depends on:

• fix: display error when fetching OAuth2 provider apps #11713 (not an actual dependency, just tracking here)
• feat: add endpoints to oauth2 provider apps response #11718
• chore: pass lifetime directly into api key generate #11715
• feat: add OAuth2 user settings page #12237
• feat: add oauth2 token exchange #11778
• feat: add oauth2 token exchange #12196

TODO

• /authorize static page
• /authorize redirect
• /tokens GET
• /tokens DELETE (revoke)
• Add endpoints for discoverability
• Refresh auth grant flow
  • Disable auto-refresh on oauth-generated API keys
• Hash secrets
• Handle other auth styles
• Handle no user agent for /authorize. Return text payload with href??
• Audit logs
  • Create app
  • Delete app
  • Edit app
  • Create secret
  • Delete secret
  • Revoke app?
  • Authorize app?
  • Token exchange?
• Allow admin to revoke an app for a user
• Documentation
• Could use an upsert for replacing the code
• Does not seem to be redirecting to login