fix: publish authentication client choices atomically
Summary
Publish OAuth bindings and typed authentication-client associations in the same transaction, and keep credential-header and Enterprise Managed Authorization choices synchronized during normal configuration changes.
Motivation
New or changed upstream configuration could remain unavailable until a migration or reconciliation ran. A failed association capture could also leave a successful binding write without its corresponding typed choice.
Impact
Enterprise Managed Authorization resource identifiers remain exact throughout configuration and selection. URLs that differ by a trailing slash no longer share authentication choices.
Technical details
One transaction and lock contract
Use a consistent organization, project, source, server, and client lock order across configuration writers, metadata updates, and administrator actions. Keep synchronization with the originating write so failures roll back the binding rather than publishing incomplete configuration.
Retire stale derived links and credentials when their backing configuration leaves scope, while preserving administrator detaches and disabled clients. Configuration does not grant access automatically.