scan.yaml / test (push) Successful in 5s
Adds the shared public forte-cli client (RFC 8628 device-code only) to the forte realm, with an oidc-audience-mapper that puts https://mcp.drop.forteapps.net/mcp into aud so the forte-drop-mcp sidecar accepts its tokens. Supersedes #26. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>