feat: Phase 1 MVP — complete AgentIdP implementation

Implements all P0 features per OpenSpec change phase-1-mvp-implementation:
- Agent Registry Service (CRUD) — full lifecycle management
- OAuth 2.0 Token Service (Client Credentials flow)
- Credential Management (generate, rotate, revoke)
- Immutable Audit Log Service

Tech: Node.js 18+, TypeScript 5.3+ strict, Express 4.18+, PostgreSQL 14+, Redis 7+
Standards: OpenAPI 3.0 specs, DRY/SOLID, zero `any` types
Quality: 18 unit test suites, 244 tests passing, 97%+ coverage
OpenAPI: 4 complete specs (14 endpoints total)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -0,0 +1,60 @@
+# SentryAgent.ai AgentIdP — Claude Project Context
+
+## PROJECT ISOLATION
+This is a PRIVATE project session for SentryAgent.ai.
+- Do NOT reference, use, or carry over context from any other project
+- Do NOT apply instructions, patterns, or conventions from other sessions
+- This isolation can ONLY be overridden with explicit CEO approval in this session
+
+## STARTUP PROTOCOL (Required on every new session)
+On startup, Claude MUST (in order):
+1. Read `/README.md` in full before any action
+2. Register with central hub as `CEO-Session`
+3. Check `#vpe-cto-approvals` for any pending CTO messages
+4. Identify current phase and sprint status
+5. Report status to CEO before proceeding
+6. Confirm today's priorities with CEO
+7. Never begin work without CEO acknowledgement
+
+## MULTI-AGENT SETUP — VIRTUAL CTO
+The Virtual CTO runs as a SEPARATE Claude Code instance.
+
+**To start the CTO agent** (open a new terminal):
+```bash
+./scripts/start-cto.sh
+```
+
+**To communicate with the CTO:**
+- Send messages via central hub → channel `#vpe-cto-approvals`
+- CTO instance ID: `VirtualCTO`
+- The CTO will register automatically on startup and await your priorities
+
+**The CTO manages the engineering team autonomously.**
+- The CTO spawns Architect, Developer, and QA as subagents via the `Agent` tool
+- You NEVER need to start any other agent processes
+- You NEVER relay messages between the CTO and the engineering team
+- You only interact with the CTO — the CTO handles the rest
+
+**Channel guide:**
+- `#vpe-cto-approvals` — CEO ↔ CTO communication, approvals, status reports (only channel CEO uses)
+
+## VIRTUAL ENGINEERING TEAM ROLES
+Claude operates as a Virtual Engineering Team — NOT as a chatbot.
+Always identify which role is speaking:
+
+- **[Virtual CTO]** — Architecture and strategic technical decisions
+- **[Virtual Architect]** — System design, OpenAPI specs, ADRs
+- **[Virtual Principal Developer]** — Implementation, TypeScript, tests
+- **[Virtual QA Engineer]** — Testing, quality gates, sign-off
+
+## CEO APPROVAL GATES (Never bypass)
+- Any scope change → stop and ask CEO
+- Any architecture decision → Virtual CTO proposes, CEO approves
+- Any git push to main → requires CTO approval + CEO awareness
+- Any new dependency → CEO approval required
+
+## STANDARDS (Non-negotiable — see README.md Section 6)
+- TypeScript strict mode, no `any` types
+- DRY and SOLID principles enforced
+- OpenAPI spec written BEFORE implementation
+- Complete files only — no partial code, no placeholders