Add OAuth support

[victor-nitu]

Why

Zendesk is deprecating API token authentication (announcement). Phase 1 begins July 28, 2026 (tokens unused for 30 days auto-deactivate; new accounts can't create tokens at all). Phase 3 on April 30, 2027 force-deactivates all remaining tokens.

This PR adds OAuth 2.0 client credentials support to our zdesk fork so we can migrate off API tokens before the deadline, with a feature flag controlling which auth method each caller uses.

What changed

zdesk/zdesk.py

• New use_oauth bool on Zendesk.__init__. When True, requires client_id and client_secret — raises ValueError at construction time if either is missing, rather than failing silently at the first API call.
• New fetch_oauth_token(client_id, client_secret) method. POSTs to /oauth/tokens with grant_type=client_credentials, sets the Bearer token on the session, and returns the full response dict (including expires_in). Raises AuthenticationError on non-200.
• Existing API token auth is unchanged — use_oauth=False (default) behaves exactly as before.

tests/test_oauth.py — 12 new unit tests (all mocked, no real Zendesk calls):

• TestFetchOauthToken: correct endpoint + payload, Bearer header set, expires_in returned, AuthenticationError on failure
• TestUseOauthConstructor: token fetched on use_oauth=True, ValueError on missing credentials, API token auth active on use_oauth=False

Usage

# OAuth (client credentials flow)
zd = Zendesk(url, use_oauth=True, client_id=client_id, client_secret=client_secret)

# API token — existing behaviour, unchanged
zd = Zendesk(url, zdesk_email=email, zdesk_api=api_token)

Since each Celery task instantiates its own client, the feature flag just controls which arguments are passed at construction — no runtime toggling needed.

Test plan

• pytest tests/test_oauth.py — 12 tests, all pass
• Instantiate with use_oauth=True and valid credentials; confirm Authorization: Bearer <token> header is set and client.auth is None
• Instantiate with use_oauth=True and missing client_secret; confirm ValueError is raised immediately
• Instantiate with use_oauth=False and API token creds; confirm existing email/token basic auth is used and no Bearer header is set