AS default-client seeding is insert-only; seed-definition changes don't reach existing DBs #154

Problem

AuthorizationServerConfig.initializeDefaultClients(...) seeds the default ESPI clients with insert-if-absent semantics:

if (repository.findByClientId(client.getClientId()) == null) {
    repository.save(client);
}

So once a client (e.g. third_party) exists in a database, changes to its seed definition never take effect on restart. Two such changes have already shipped that will NOT reach an already-seeded DB:

• Repair AS integration test infrastructure (pre-existing pre-#122) #149 — friendly clientName on data_custodian_admin / third_party / third_party_admin.
• PR D: Phase 2.0 integration test — auth-code flow + introspection + token-response augmentation end-to-end (closes #122 Step 6) #148 — requireProofKey(false) on third_party (without which the ESPI customer auth-code flow fails with [invalid_request] OAuth 2.0 Parameter: code_challenge, since ESPI does not use PKCE and Spring AS 7.x otherwise requires it).

Operational impact

Any existing AS deployment (including the current dev/sandbox MySQL) will keep the stale third_party row and continue to reject the customer flow with the PKCE error until the client is re-created. Workarounds today:

• fresh DB (re-seed from scratch), or
• update the row via the admin API / SQL: set require_proof_key/client_settings appropriately on oauth2_registered_client where client_id='third_party'.

Options to consider

1. Upsert on startup — update existing default clients to match the seed definition. Risk: clobbers any admin-made changes to those clients on every restart.
2. Flyway data migration — one-off corrective migration to set require_proof_key=false (and names) on the known default client_ids.
3. Version/checksum the seed — only update when the seed definition version changes.

Option 2 is the lowest-risk way to fix existing deployments for the two shipped changes; option 1/3 is the longer-term answer for seed drift.

Surfaced during #148 (Phase 2.0 orchestration test).