feat: implement tenant OAuth flow and guest achievements

database/seeders/OAuthClientSeeder.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\OAuthClient;
+use App\Models\Tenant;
+use Illuminate\Database\Seeder;
+use Illuminate\Support\Str;
+
+class OAuthClientSeeder extends Seeder
+{
+    /**
+     * Run the database seeds.
+     */
+    public function run(): void
+    {
+        $clientId = 'tenant-admin-app';
+        $tenantId = Tenant::where('slug', 'demo')->value('id')
+            ?? Tenant::query()->orderBy('id')->value('id');
+
+        $redirectUris = [
+            'http://localhost:5174/auth/callback',
+            'http://localhost:8000/auth/callback',
+        ];
+
+        $scopes = [
+            'tenant:read',
+            'tenant:write',
+        ];
+
+        $client = OAuthClient::firstOrNew(['client_id' => $clientId]);
+
+        if (!$client->exists) {
+            $client->id = (string) Str::uuid();
+        }
+
+        $client->fill([
+            'client_secret' => null, // Public client, no secret needed for PKCE
+            'tenant_id' => $tenantId,
+            'redirect_uris' => $redirectUris,
+            'scopes' => $scopes,
+            'is_active' => true,
+        ]);
+
+        $client->save();
+    }
+}