#4372 serve OAuth client reuse: remaining review findings from swamp-club#4264

Non-blocking findings left open by the swamp-club#4264 change (swamp PR #3602).

1. serve daemon enable ignores SWAMP_OAUTH_CLIENT_ID. The daemon unit carries only SWAMP_HOME and SWAMP_CONFIG_DIR, but the daemon enable help says --oauth-client-id has an env form. Setting only the variable validates cleanly and writes a unit with no client id, so the service registers a new client on first start. Fix: correct the help text and warn at enable time when the variable is set without the flag. Other daemon enable options share the gap, but this one creates a stray client.
2. serve daemon enable accepts --oauth-client-secret-file with no client id. The service then fails on every start. Fix: refuse it at enable time without reading the file, which may not be mounted yet.
3. With --keep-oauth-client-in-vault, rotating oauth-client-secret in the user vault has no effect while the datastore persists, because _token-secrets keeps its first copy and the migration marker stops further user-vault reads. OAuth then fails at token exchange. Fix: document it in design/primitives/serve.md and the manual (see swamp-club#4366).
4. auth oauth-client register can report --oauth-provider must use HTTPS when the value came from SWAMP_CLUB_URL. Fix: name the setting the value came from.
5. auth oauth-client register has no integration test wiring the generator to registerClientWithApiKey against a port-0 mock server. Unit tests cover each side separately.
6. buildEnvContext now hides SWAMP_OAUTH_CLIENT_SECRET from env.* in expressions, but SWAMP_API_KEY is still visible there. Decide whether to hide it too, checking first whether any expression relies on it. Extension code runs in-process and is out of scope for this filter.