fix: fetch OIDC discovery before building authorization URL (#91)

get_authorize_url() was synchronous and fell back to constructing
{issuer}/authorize when the discovery cache was empty. This produced
incorrect URLs for providers like Keycloak whose authorization
endpoint is {issuer}/protocol/openid-connect/auth.

Made get_authorize_url() async so it can call get_discovery() to
fetch the real authorization_endpoint from .well-known/openid-configuration
before the first redirect. The discovery document is cached after the
initial fetch.

src/application/services/auth_application_service.rs

@@ -785,7 +785,7 @@ impl AuthApplicationService {
 
     /// Prepare the OIDC authorization flow: generates CSRF state, PKCE pair,
     /// nonce, stores them in pending_oidc_flows, and returns the authorize URL.
-    pub fn prepare_oidc_authorize(&self) -> Result<String, DomainError> {
+    pub async fn prepare_oidc_authorize(&self) -> Result<String, DomainError> {
         let oidc = self.oidc_service().ok_or_else(|| DomainError::new(
             ErrorKind::InternalError, "OIDC", "OIDC service not configured",
         ))?;
@@ -826,7 +826,7 @@ impl AuthApplicationService {
         }
 
         // Build authorization URL with state, nonce, and PKCE challenge
-        let authorize_url = oidc.get_authorize_url(&state_token, &nonce, &pkce_challenge)?;
+        let authorize_url = oidc.get_authorize_url(&state_token, &nonce, &pkce_challenge).await?;
 
         tracing::info!("OIDC authorize flow prepared (state={}...)", &state_token[..8]);