Sub-issue 4a of #5145. Creates the shared pkg/auth/dcr package and
migrates the embedded authserver to consume it. The CLI flow
migration (pkg/auth/discovery::PerformOAuthFlow) is left to
sub-issue 4b (#5219) so this slice stays under the project's
PR-size limit.

Files moved (renamed via git mv so the diff shows as renames, not
deletions + additions):

  pkg/authserver/runner/dcr.go              -> pkg/auth/dcr/resolver.go
  pkg/authserver/runner/dcr_store.go        -> pkg/auth/dcr/store.go
  pkg/authserver/runner/dcr_test.go         -> pkg/auth/dcr/resolver_test.go
  pkg/authserver/runner/dcr_store_test.go   -> pkg/auth/dcr/store_test.go
  pkg/authserver/runner/dcr_testhelpers_test.go -> pkg/auth/dcr/testhelpers_test.go

Public API surface (renamed from runner-package internals because
they now cross a package boundary):

  Resolution            (was DCRResolution)
  Key                   (was DCRKey, alias to storage.DCRKey unchanged)
  CredentialStore       (was the package-private dcrResolutionCache)
  ResolveCredentials    (was resolveDCRCredentials)
  NeedsDCR              (was needsDCR)
  ConsumeResolution     (was consumeResolution)
  ApplyResolutionToOAuth2Config (was applyResolutionToOAuth2Config)
  LogStepError          (was logDCRStepError)
  NewInMemoryStore      (new convenience constructor wrapping
                         storage.NewMemoryStorage; mirrors the pattern
                         the per-test newMemoryDCRStore helpers use)
  NewStorageBackedStore (was the package-private newStorageBackedStore)
  SanitizeErrorForLog   (was sanitizeErrorForLog; promoted to
                         exported because the deferred-cleanup log
                         path in pkg/authserver/runner needs it)

Names follow the pkg/auth/dcr.* form so the linter's stuttering
check (revive: dcr.DCRResolution would stutter) passes and the
surface reads as ordinary package API.

resolveSecret was duplicated into the dcr package because
pkg/auth/dcr must stay profile-agnostic and cannot reach back into
pkg/authserver/runner. The duplication is intentional and called
out in a comment; future consolidation can move it into a shared
helper if a third caller appears. A parallel TestResolveSecret /
TestResolveSecretWithEnvVar suite in pkg/auth/dcr/secret_test.go
mirrors the runner-package twin's observable contract so any
future drift between the two copies fails CI on at least one side.

Review-feedback bits applied alongside the move:

- Package doc comment in pkg/auth/dcr/resolver.go now documents the
  process-global singleflight in a Concurrency section, and labels
  the profile-agnostic framing as a target state for sub-issue 4b
  rather than as a description of the current API shape (the
  package's public API still takes embedded-authserver types).
- dcrFlight var doc gains a cross-consumer caveat naming the
  "third consumer with colliding redirect URI" failure mode.
- Flight-key construction extracted into flightKeyOf(Key) string so
  the canonical key shape is inspectable rather than buried in a
  string-concatenation literal.
- endpointsFromMetadata gains a defensive nil check; the function's
  doc comment names the oauthproto contract being defended.
- newMemoryDCRStore test helper is duplicated across the two
  packages because Go test helpers cannot be shared without
  exporting them; the duplication is documented at both sites.

Acceptance criteria status (#5145):

  AC#1 (pkg/auth/dcr exists, exports a stateful resolver, consumed
       by both call sites): partially met — package exists and is
       consumed by EmbeddedAuthServer. CLI flow migration is
       sub-issue 4b (#5219).
  AC#2 (stateless RFC 7591 helpers in pkg/oauthproto): met
       (already satisfied before this PR).
  AC#3 (no direct oauthproto.RegisterClientDynamically calls
       outside pkg/auth/dcr): not yet met — pkg/auth/discovery
       still calls it. Resolved by sub-issue 4b (#5219).
  AC#4 (review-property behaviours apply to CLI flow): not yet
       met — same dependency on 4b (#5219).

Closes #5220.

Verified via task lint-fix (0 issues), task license-check (clean),
and go test -count=1 -race ./pkg/auth/dcr/... ./pkg/authserver/...
(all pass).