Add API tokens and OAuth2 client support for external integrations

- Personal API tokens (model, user-settings UI, admin, management command,
  DRF auth class) for non-interactive API access from automations like n8n.
  Raw token shown once; only a SHA-256 hash is stored; last_used_at writes
  are throttled.
- OAuth2 authorization server via django-oauth-toolkit with authorization
  server metadata and optional, off-by-default Dynamic Client Registration
  (RFC 7591), so remote OAuth/MCP clients can authenticate and self-register.
- Tests for token auth, DCR gating and the management commands, plus
  .env.example and README documentation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/WYGIWYH/urls.py

@@ -22,6 +22,10 @@ from drf_spectacular.views import (
     SpectacularSwaggerView,
 )
 from allauth.socialaccount.providers.openid_connect.views import login, callback
+from apps.common.oauth_views import (
+    authorization_server_metadata,
+    dynamic_client_registration,
+)
 
 
 urlpatterns = [
@@ -39,6 +43,17 @@ urlpatterns = [
         name="swagger-ui",
     ),
     path("auth/", include("allauth.urls")),  # allauth urls
+    path("oauth/", include("oauth2_provider.urls", namespace="oauth2_provider")),
+    path(
+        ".well-known/oauth-authorization-server",
+        authorization_server_metadata,
+        name="oauth-authorization-server-metadata",
+    ),
+    path(
+        "oauth/register/",
+        dynamic_client_registration,
+        name="oauth-dynamic-client-registration",
+    ),
     # path("auth/oidc/<str:provider_id>/login/", login, name="openid_connect_login"),
     # path(
     #     "auth/oidc/<str:provider_id>/login/callback/",