Spike: OAuth Application management UI

### Scope

The OAuth epic (#5227) does not include a user-facing UI for creating or managing OAuth Applications. #7033 (Dynamic Client Registration) only handles public MCP clients. Confidential clients (like an IdP's SCIM client needing client_id + client_secret for client credentials grant) can currently only be created via Django Admin.

Spike whether OAuth Application management should be:
- A standalone page in Organisation Settings (list, create, revoke Applications)
- Embedded in feature-specific UIs (e.g. the SCIM tab creates the Application inline)
- Left to Django Admin for self-hosted, with a managed flow for SaaS

This spike is not blocking the SCIM OAuth integration — Django Admin is a viable fallback for creating confidential OAuth Applications until a UI exists.

Start with OAuth epic #5227 and Dynamic Client Registration #7033, then inspect the existing Django Admin path for confidential OAuth Applications and the SCIM integration context. Compare standalone Organisation Settings, inline SCIM, and self-hosted/SaaS options; done means a documented recommendation and scope, while confirming Django Admin remains a viable fallback.

Written by the indexing model from the issue text.