Add AMS-specific secret type to the generalized broker (src/orb/broker.ts)

[JSONbored]

Problem

The auth direction for hosted AMS is ratified (reuse ORB's installation-based broker, #4941 closed) and #7174 already generalized src/orb/broker.ts to support multiple secret types — but only ORB_SECRET_TYPE_GITHUB_TOKEN is actually mintable today. No AMS-specific secret type exists, and nothing wires a miner-facing login/session through the broker yet. Decided: start this now, in parallel with #5230's other sequencing gates, since the pattern is already proven.

Area

src/orb/broker.ts, src/orb/oauth.ts.

Proposal

Add an AMS-facing secret type to the broker's existing secret_type discriminator (mirroring the GitHub-token strategy's shape), and the corresponding mint/refresh logic. This is additive to #7174's already-generalized broker, not a new auth system.

Deliverables

• A new secret-type strategy for AMS/miner sessions, following the existing GitHub-token strategy's pattern exactly.
• Tests covering mint/refresh for the new type, mirroring existing broker test coverage.

Resources

• Generalize src/orb/broker.ts into a multi-secret-type broker shared by ORB + AMS hosted #7174 (the generalized broker this extends)
• Design an auth/identity layer for AMS #4941 (the ratified auth direction)
• src/orb/broker.ts, src/orb/oauth.ts

Boundaries

Extends the existing broker only — no parallel/bespoke AMS auth system.

maintainer-only — secrets custody, needs maintainer review per this repo's own bar for anything in this cluster.

[linear-code]

JSO-5420