OAuth Request Should Accept client_id and client_secret via Headers, Not Just in the Request Body

Describe the bug

When attempting to integrate with the OpenAI connector, the /token request fails because OpenAI sends the client_id and client_secret via the Authorization header, not in the request body.

The body /token request looks like this:

{
  "grant_type": "authorization_code",
  "code": "62cd621bf6e44fd88be3f98f3a8aba37",
  "redirect_uri": "https://chatgpt.com/connector_platform_oauth_redirect",
  "code_verifier": "mBLha_DC8fq_tnLSk3sWF0kpi3sda8yKKpsr_4k3vo"
}

Since the credentials are not in the body, the server does not recognize them and the authentication fails.

To Reproduce

Steps to reproduce the behavior:

1. Attempt to integrate with the OpenAI connector.
2. Use ProxyOAuthServerProvider for handling the /token request.
3. Observe the failure due to missing credentials in the request body.

Expected behavior

From the code here, it appears that the implementation only reads client_id and client_secret from the request body.

This works for many clients, but fails in the case of OpenAI, which uses the Authorization header instead. The server should support extracting these credentials from the Authorization header (typically using Basic Auth) as well as from the body to ensure broader compatibility.

Start in src/server/auth/middleware/clientAuth.ts at the referenced credential-extraction logic. Reproduce a ProxyOAuthServerProvider /token request using the OpenAI connector pattern, where client_id and client_secret arrive through the Authorization header rather than the body. The work is done when header-based credentials are accepted while existing body-based requests continue to work.