[POC] [DO NOT MERGE] feat(relier-demo): add OAuth relier demo site

[vpomerleau]

Proof of concept. Do not merge. Local-dev only; opened for discussion of a 123done replacement.

Because

• 123done shows none of what an OAuth flow yields: scopes, claims, tokens, or the callback.
• Trying a different client or parameter set means editing config files or hand-building URLs.
• A relying party evaluating Mozilla accounts has nothing to try that explains itself.

This pull request

• Adds packages/fxa-relier-demo, a browser-only public PKCE client with no server, built with esbuild and React and styled with Acorn/Nova tokens.
• Offers scenario cards (email first, sign-in/up with a known email, Mozilla app vs third-party, scoped keys, prompt=none, prompt=login, AAL2), each opening an editable request builder with a live authorize URL and a plain-language prediction of what FxA will do.
• Shows the callback, decoded and JWKS-verified id_token, introspection, userinfo, a scope-to-claim matrix, and in-tab decryption of scoped keys.
• Includes a copy-ready client registration request derived from the flow just run.
• Registers two public dev clients (trusted and untrusted) on port 8090 in auth-server dev.json.
• Allowlists the trusted demo client for prompt=none and scoped keys in content-server config.

Issue that this pull request solves

Closes: N/A

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: src/oauth.ts (PKCE, token exchange, verification), src/scopes.ts (scope-to-claim catalogue), the two dev-config edits.
• Suggested review order: README, scenarios.ts, oauth.ts, then the screens.
• Risky or complex parts: none in production paths; only dev config is touched.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Run locally with yarn start mza then nx start fxa-relier-demo, open http://localhost:8090.
Verified end to end against the local stack: sign-up, sign-in with a known email, third-party consent, scoped keys, prompt=none without a session.
/fxa-security-review run: no Critical, High, or Medium findings.
Not in scope: server component, functional-test wiring, hosting, subscriptions. No ticket; this is a discussion artifact.

🤖 Generated with Claude Code