fix(config,dcr): env fallbacks, DCR self-heal, per-source auth gate

- implement documented OIDC_* env fallbacks; hold metadataMu for clientAssertion write
- re-register client when client_secret expires; require secret for confidential
- add opt-in per-source external auth rate limiting (PerSourceLoginRateLimit)

types.go

@@ -116,6 +116,7 @@ type TraefikOidc struct {
 	introspectionCache           CacheInterface
 	initComplete                 chan struct{}
 	limiter                      *rate.Limiter
+	perSourceLimiter             *perSourceAuthLimiter // optional per-external-source auth throttle (R185), nil when disabled
 	headerTemplates              map[string]*template.Template
 	sessionManager               *SessionManager
 	tokenCleanupStopChan         chan struct{}
@@ -160,7 +161,20 @@ type TraefikOidc struct {
 	clientSecret                 string
 	clientAuthMethod             string
 	clientAssertion              *ClientAssertionSigner
-	registrationURL              string
+	// clientSecretExpiresAt is the RFC 7591 userinfo client_secret_expires_at
+	// (unix seconds) returned at DCR registration, or 0 when the IdP
+	// grants a non-expiring secret. Guarded by metadataMu like the other
+	// DCR-installed credential fields; used by dcrRegistrationNeeded to
+	// re-register a client whose secret has lapsed (R180).
+	clientSecretExpiresAt int64
+
+	// dcrClientAssertionBuilder lazily builds a client-assertion signer
+	// from the static config's key material. Used when DCR provisions a
+	// private_key_jwt client but no signer was built at construction
+	// (because the static ClientAuthMethod was not private_key_jwt); see
+	// R162 / updateMetadataEndpoints.
+	dcrClientAssertionBuilder func() (*ClientAssertionSigner, error)
+	registrationURL           string
 	// configRevocationURL, configEndSessionURL, and configIntrospectionURL
 	// hold operator-configured endpoint overrides (Config.RevocationURL,
 	// Config.OIDCEndSessionURL, Config.IntrospectionURL). They are set once at