Consolidate registration endpoint synthesis into pkg/oauthproto

Context

PR #5357 added an endpoint synthesis block in resolveDCRCredentials (pkg/auth/discovery/discovery.go:737-745) to handle the ErrRegistrationEndpointMissing case when re-fetching AS metadata. This logic duplicates synthesiseRegistrationEndpoint in pkg/auth/dcr/resolver.go:1020-1033, which is unexported and unreachable from pkg/auth/discovery.

The duplication was called out as a non-blocking nit during review of #5357. Both sites implement the same nanobot/Hydra convention: build {issuer}/register by joining the issuer's scheme, host, and trimmed path with /register.

Problem

Two identical implementations of the same URL construction rule will drift if either site is updated (e.g. scheme/host validation is added to one, or the convention changes). There is no test that the two sites produce identical output for the same input.

Proposed fix

1. Move synthesiseRegistrationEndpoint (or an equivalent) to pkg/oauthproto, the natural home for AS URL construction utilities alongside FetchAuthorizationServerMetadata and buildDiscoveryURLs.
2. Update both call sites — pkg/auth/dcr/resolver.go and pkg/auth/discovery/discovery.go — to use the shared function.
3. Add a test asserting both callers produce identical results for the same issuer input.

This work is a natural companion to the larger follow-up of threading code_challenge_methods_supported through AuthServerInfo (also noted in #5357), which would eliminate the re-fetch in resolveDCRCredentials entirely and with it the second call site.

References

• #5357 (introduced the duplication, fix for #5356)
• pkg/auth/dcr/resolver.go:1020 — synthesiseRegistrationEndpoint
• pkg/auth/discovery/discovery.go:737 — duplicate inline block

Start with synthesiseRegistrationEndpoint in pkg/auth/dcr/resolver.go:1020-1033 and the duplicate block in pkg/auth/discovery/discovery.go:737-745, then inspect pkg/oauthproto alongside FetchAuthorizationServerMetadata and buildDiscoveryURLs. Move the shared URL construction there, update both callers, and add a test showing identical results for the same issuer input. Run the affected Go package tests to verify the shared behavior.