fix: fetch OIDC discovery before building authorization URL (#91)

get_authorize_url() was synchronous and fell back to constructing
{issuer}/authorize when the discovery cache was empty. This produced
incorrect URLs for providers like Keycloak whose authorization
endpoint is {issuer}/protocol/openid-connect/auth.

Made get_authorize_url() async so it can call get_discovery() to
fetch the real authorization_endpoint from .well-known/openid-configuration
before the first redirect. The discovery document is cached after the
initial fetch.

src/application/ports/auth_ports.rs

@@ -138,7 +138,8 @@ pub struct OidcIdClaims {
 pub trait OidcServicePort: Send + Sync + 'static {
     /// Get the authorization URL for redirecting the user to the IdP.
     /// Includes PKCE code_challenge (S256) and nonce for ID token binding.
-    fn get_authorize_url(&self, state: &str, nonce: &str, pkce_challenge: &str) -> Result<String, DomainError>;
+    /// This is async because it may need to fetch the OIDC discovery document.
+    async fn get_authorize_url(&self, state: &str, nonce: &str, pkce_challenge: &str) -> Result<String, DomainError>;
 
     /// Exchange an authorization code for tokens, providing PKCE code_verifier.
     async fn exchange_code(&self, code: &str, pkce_verifier: &str) -> Result<OidcTokenSet, DomainError>;