feat: add OAuth APIs with scoped permissions (#1542)

Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com>

backend/resources/migrations/sqlite/20260624120000_oauth_apis.down.sql

@@ -0,0 +1,9 @@
+PRAGMA foreign_keys=OFF;
+BEGIN;
+
+DROP TABLE IF EXISTS oidc_clients_allowed_api_permissions;
+DROP TABLE IF EXISTS api_permissions;
+DROP TABLE IF EXISTS apis;
+
+COMMIT;
+PRAGMA foreign_keys=ON;

backend/resources/migrations/sqlite/20260624120000_oauth_apis.up.sql

@@ -0,0 +1,32 @@
+PRAGMA foreign_keys=OFF;
+BEGIN;
+
+CREATE TABLE apis (
+    id TEXT NOT NULL PRIMARY KEY,
+    created_at DATETIME NOT NULL,
+    updated_at DATETIME,
+    name TEXT NOT NULL,
+    audience TEXT NOT NULL UNIQUE
+);
+
+CREATE TABLE api_permissions (
+    id TEXT NOT NULL PRIMARY KEY,
+    created_at DATETIME NOT NULL,
+    api_id TEXT NOT NULL REFERENCES apis(id) ON DELETE CASCADE,
+    key TEXT NOT NULL,
+    name TEXT NOT NULL,
+    description TEXT,
+    UNIQUE (api_id, key)
+);
+
+CREATE INDEX idx_api_permissions_api_id ON api_permissions(api_id);
+
+CREATE TABLE oidc_clients_allowed_api_permissions (
+    oidc_client_id TEXT NOT NULL REFERENCES oidc_clients(id) ON DELETE CASCADE,
+    api_permission_id TEXT NOT NULL REFERENCES api_permissions(id) ON DELETE CASCADE,
+    subject_type TEXT NOT NULL CHECK (subject_type IN ('user', 'client')),
+    PRIMARY KEY (oidc_client_id, api_permission_id, subject_type)
+);
+
+COMMIT;
+PRAGMA foreign_keys=ON;