chore(fmt): gofmt cleanup on three pre-bundle drift files surfaced by v2.1.0 release-gate Phase 1

Phase 1 (make verify) of cowork/v2.1.0-release-gate.md surfaced three
files with pre-existing gofmt drift that pre-dated the 2026-05-11 fix
bundle work:

  internal/auth/oidc/domain/types.go
  internal/auth/oidc/integration_keycloak_rotate_test.go
  internal/auth/oidc/test_discovery.go

The 2026-05-11 Fix 08 fmt-cleanup commit (b8fac59) fixed four files
that the merge introduced; these three were noted as pre-existing
master drift and intentionally left untouched at the time. The
v2.1.0 release-gate spec's Phase 1 requires zero gofmt output from
'go fmt ./...' (Makefile::verify form), so the drift must close
before tagging.

Pure whitespace alignment, no semantic change.

internal/auth/oidc/integration_keycloak_rotate_test.go

@@ -46,10 +46,10 @@ import (
 //  2. Rotate the realm's RSA key via the Keycloak admin API.
 //  3. Run a fresh /auth/oidc/login → /auth/oidc/callback flow.
 //     - Keycloak signs the new ID token under the new (higher-priority)
-//       key.
+//     key.
 //     - certctl's verifier holds the pre-rotate JWKS in cache.
 //     - The verify trips kid-not-in-cache → MED-6 auto-refresh fires →
-//       second verify succeeds.
+//     second verify succeeds.
 //  4. Assert the callback succeeded without the test having called
 //     RefreshKeys (which would mask the MED-6 path).
 //