✨(backend) add application model with secure secret handling

We need to integrate with external applications. Objective: enable them to
securely generate room links with proper ownership attribution.

Proposed solution: Following the OAuth2 Machine-to-Machine specification,
we expose an endpoint allowing external applications to exchange a client_id
and client_secret pair for a JWT. This JWT is valid only within a well-scoped,
isolated external API, served through a dedicated viewset.

This commit introduces a model to persist application records in the database.
The main challenge lies in generating a secure client_secret and ensuring
it is properly stored.

The restframework-apikey dependency was discarded, as its approach diverges
significantly from OAuth2. Instead, inspiration was taken from oauthlib and
django-oauth-toolkit. However, their implementations proved either too heavy or
not entirely suitable for the intended use case. To avoid pulling in large
dependencies for minimal utility, the necessary components were selectively
copied, adapted, and improved.

A generic SecretField was introduced, designed for reuse and potentially
suitable for upstream contribution to Django.

Secrets are exposed only once at object creation time in the Django admin.
Once the object is saved, the secret is immediately hashed, ensuring it can
never be retrieved again.

One limitation remains: enforcing client_id and client_secret as read-only
during edits. At object creation, marking them read-only excluded them from
the Django form, which unintentionally regenerated new values.
This area requires further refinement.

The design prioritizes configurability while adhering to the principle of least
privilege. By default, new applications are created without any assigned scopes,
preventing them from performing actions on the API until explicitly configured.

If no domain is specified, domain delegation is not applied, allowing tokens
to be issued for any email domain.

src/backend/core/utils.py

@@ -8,6 +8,7 @@ Utils functions used in the core app
 import hashlib
 import json
 import random
+import string
 from typing import List, Optional
 from uuid import uuid4
 
@@ -240,3 +241,42 @@ async def notify_participants(room_name: str, notification_data: dict):
         raise NotificationError("Failed to notify room participants") from e
     finally:
         await lkapi.aclose()
+
+
+ALPHANUMERIC_CHARSET = string.ascii_letters + string.digits
+
+
+def generate_secure_token(length: int = 30, charset: str = ALPHANUMERIC_CHARSET) -> str:
+    """Generate a cryptographically secure random token.
+
+    Uses SystemRandom for proper entropy, suitable for OAuth tokens
+    and API credentials that must be non-guessable.
+
+    Inspired by: https://github.com/oauthlib/oauthlib/blob/master/oauthlib/common.py
+
+    Args:
+        length: Token length in characters (default: 30)
+        charset: Character set to use for generation
+
+    Returns:
+        Cryptographically secure random token
+    """
+    return "".join(secrets.choice(charset) for _ in range(length))
+
+
+def generate_client_id() -> str:
+    """Generate a unique client ID for application authentication.
+
+    Returns:
+        Random client ID string
+    """
+    return generate_secure_token(settings.APPLICATION_CLIENT_ID_LENGTH)
+
+
+def generate_client_secret() -> str:
+    """Generate a secure client secret for application authentication.
+
+    Returns:
+        Cryptographically secure client secret
+    """
+    return generate_secure_token(settings.APPLICATION_CLIENT_SECRET_LENGTH)