Just-in-time confidential-client secret resolution.

Resolver callbacks receive only a prevalidated binding identifier and the caller's absolute local deadline. They may return a bounded binary directly or %{value: binary, release: zero_arity_function}. The latter release callback always runs after the immediate OAuth request.