[marekdano]

Summary

Closes #5815.

An A2A agent with auth_type="oauth" stored oauth_config, but no code path used it. The gateway now gets an agent-level client_credentials token before it calls the agent. It validates the token before it forwards it.

Changes

• Add mcpgateway/services/a2a_oauth.py. resolve_a2a_oauth_headers() requests the token, validates it, caches it, and returns the Authorization header.
• Send the RFC 8707 resource on the token request. The value is oauth_config["resource"], else the origin of the agent endpoint (derive_resource_origin()).
• Validate the token with validate_oauth_token_claims(). A mismatch of a configured audience, scopes, or issuer blocks the call. A mismatch of a derived audience is advisory unless OAUTH_REQUIRE_CONFIGURED_RESOURCE=true.
• Cache the token per agent in the existing service-token cache. Only validated tokens enter the cache. The key covers the resource and the client credentials.
• Add send_resource to OAuthManager.get_client_credentials_token_response(). The default is False, so gateway and discovery callers send the same request as before.
• Add oauth_headers to prepare_a2a_invocation(). The gateway applies it only when auth_type="oauth".
• Wire the token into A2AAgentService.invoke_agent and both A2A paths in ToolService.
• Add the Resource (Audience) field to the A2A agent create and edit forms in the Admin UI. Stop passing include_resource=False in the two A2A admin handlers.
• Document the A2A token lifecycle in oauth-resource-configuration.md.

Behavior

• Only client_credentials is supported. Any other grant_type fails with an A2AAgentError that names the grant type.
• Token request failures return a generic message. The IdP error detail stays in the logs.
• The gateway never logs the token.
• No schema, API, or environment variable change.

Decisions

• The token lifecycle is agent-level. The per-user authorization_code flow with token storage and refresh is deferred by design. It needs an Alembic migration and goes in a separate issue.
• The web UI needs no change. Its agent form already sends client_credentials.