fix(client/auth): discard stored client registrations whose secret has expired - #3264

This PR changes user-visible behavior (a stored registration with a lapsed `client_secret_expires_at` is now discarded on load, minting a fresh `client_id` on the next 401 flow) but doesn't update `docs/client/oauth-clients.md`, which now contains two stale statements: "Stored `client_info` still wins over both." and "The provider registers dynamically the first time it finds no stored `client_info`." A small edit to that existing page mentioning the expired-secret discard would satisfy the AGEN

The new `stored_registration_expired()` check only runs in `_initialize()`, which executes once per provider instance — so if the secret lapses while the process is running (the long-lived-client scenario from #3256), the stale in-memory `context.client_info` is never re-validated: with no refresh token, the 401 flow skips re-registration, runs a full interactive authorization, then fails at token exchange with `invalid_client`, and repeats identically on every request until process restart. Con