[Portal] Framework-first Create Application wizard

[fungc-io]

Summary

Replaces the type-first "Create Application" screen with a framework-first wizard and builds out Quick Start tabs per client kind. The portal's OAuth-app management UX is redesigned around what the user is building (React, Django, iOS, etc.) instead of OAuth taxonomy.

Backend

• New optional x_framework field on OAuthClientConfig (pkg/lib/config/oauth.go). JSON-schema enum of allowed framework ids. Nullable, additive, no migration needed. The auth server never branches on this field — it's a portal-only label.

Portal — Create flow

• Apps-list header now exposes a split button: Application → new framework wizard at /configuration/apps/add, Machine-to-Machine → extracted M2M flow at /configuration/apps/add-m2m.
• New wizard renders a framework grid (Website + Mobile · Desktop sections) using ChoiceButton tiles (consistent with Login Methods). Picking a server framework reveals an inline Stage 2 ("OIDC tokens" / "Cookie session via reverse proxy") — defaults to OIDC tokens with the nginx docs link clickable below.
• Frameworks → application-type mapping is encapsulated in frameworks.ts via resolveType(stage2?). Submitting writes both x_application_type and x_framework.
• On success the wizard deep-links to …/edit?tab=quick-start.

Portal — App details

• New header above the tabs: framework icon, name, type + monospaced client ID with copy.
• Apps-list redesigned: each row shows the framework icon, name, and a Type · Framework subline.
• Settings tab: visual separators between sections; the Cookie-based authentication note is hidden for non-cookie clients.

Portal — Quick Start tab

A new tab for every framework-typed client (spa / traditional_webapp / native / confidential), in addition to the existing M2M Quick Start.

• Shows the selected framework with a Change framework dialog (same ChoiceButton grid as the create wizard, filtered to same-type frameworks). Changes save on Apply via saveWithState.
• Cookie SSO clients get an nginx-specific tutorial body and a Read user session in your code code snippet per framework (Express / Flask / Laravel / Java Spring Boot / ASP.NET Core MVC), with copy buttons.
• "Other OIDC/SAML compatible" gets a dedicated panel with Client ID, Client Secret (with Reveal / copy), OpenID scope, and the OIDC endpoints (Login / Userinfo / Token / End Session / JWK Set).
• SAML tab is hidden for OIDC-only confidential frameworks (Express / Flask / Laravel / Java / ASP.NET); kept for legacy and other-oidc clients.
• Type-label rename in i18n only: "Single Page Application" → "Public Client", "Traditional Web Application" → "Cookie SSO", "OIDC/SAML Client Application" → "Confidential Client". Enum values unchanged.

Misc fixes / polish

• Wizard auto-focuses the Name input on load.
• Empty-state on Quick Start (no framework set) redesigned as a centered card.
• Responsive framework grid: repeat(auto-fill, minmax(240px, 1fr)) so columns reflow on narrow viewports.
• Express moved from the SPA cluster to the server cluster in the catalog order.

ref DEV-2392

Related: DEV-2532 (richer per-framework Quick Start content) — out of scope here.

Test plan

• Backend: `go test ./pkg/lib/config/`
• Backend: `go build ./...`
• Portal: `npm run typecheck`
• Portal: `npx jest` (168 tests across 27 suites)
• Manual — split button menu shows both Application and Machine-to-Machine options
• Manual — SPA framework (React) → no Stage 2; submits with `x_application_type=spa`, `x_framework=react`
• Manual — Server framework (Flask, Java, ASP.NET) → Stage 2 visible, OIDC tokens preselected
• Manual — Stage 2 OIDC tokens → `confidential`; Cookie SSO → `traditional_webapp`; switching framework clears Stage 2 silently
• Manual — Reserved/duplicate name → inline error
• Manual — Submit lands on `…/edit?tab=quick-start`
• Manual — Quick Start tab visible for spa / traditional_webapp / native / confidential / m2m
• Manual — Change framework dialog (filtered per type) → Apply saves immediately
• Manual — Cookie SSO client: tutorial points at `/backend-api/nginx`, per-framework code snippet renders with copy
• Manual — Other OIDC/SAML compatible: OIDC endpoints panel renders with Reveal button on Client Secret
• Manual — Confidential + per-framework: SAML tab hidden; confidential + other-oidc or legacy: SAML tab shown
• Manual — Apps list redesign: icon + Type · Framework subline; M2M uses server icon

🤖 Generated with Claude Code

[tung2744]

@fungc-io Should I review this?

[fungc-io]

@tung2744 , no, it's still in progress, i've changed it to draft
Thanks