Remove confidential Swagger OAuth client secret from browser configuration

[Subhransu-De]

What to build

Adjust Swagger/OpenAPI OAuth configuration so the browser UI does not receive a confidential OIDC client secret. The template should prefer a public OAuth client with PKCE for interactive docs.

Acceptance criteria

• Swagger UI config no longer passes clientSecret to the browser.
• Docs describe the expected OIDC client type for Swagger UI.
• PKCE-based authorization code flow remains supported for local interactive API docs.
• Tests or configuration checks cover the safer default.

Blocked by

None - can start immediately.