Ory Hydra integration

Ory Hydra is an OAuth 2.0 and OpenID Connect server. This catalog entry covers its administrative surface, the part a machine can drive: register, list, read, replace, patch and delete OAuth 2.0 clients, override a client's token lifespans, rotate a client secret and drop the rotated ones, manage JSON Web Key Sets and individual keys (create, read, replace, delete), read a pending login, consent or logout request by its challenge and accept or reject it, accept a device user code, list and revoke a subject's consent sessions, invalidate a subject's login sessions, introspect an access or refresh token to see whether it is still active and what it was granted, revoke every token issued to a client or subject, manage the trusted issuers allowed to use the JWT bearer grant, and read server version and readiness. The browser-facing legs are deliberately absent: the authorize, device verification and OIDC logout endpoints redirect a user agent, the token, revocation and dynamic client registration endpoints authenticate as the OAuth client rather than as an administrator, and the discovery documents describe the deployment rather than doing work. The host is part of the credential because every install is its own deployment: point it at the Hydra admin endpoint (port 4445 by default) or at an Ory Network project URL. Authentication is an API key sent as a bearer token in the Authorization header; a self-hosted admin endpoint is often left unauthenticated behind a private network or a proxy instead, in which case any placeholder value is accepted.