feat: update README draft link and operation policy text

[fudaiyf]

Description

This PR improves the authorization consent UX, optimizes the LLM-powered operation policy rendering, makes PAR request expiry configurable, and updates the IETF Draft reference links.

Root cause: E2E tests were failing because the PAR (Pushed Authorization Request) expiry was hardcoded to 90 seconds in DefaultOAuth2ParServer, which was insufficient for flows involving multiple redirects (Agent → AS → User IDP → OIDC consent → AS callback → AOA consent) especially when using slower LLM models like qwen3-coder-plus.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Performance improvement
• Code refactoring
• Test additions or updates
• Other (please describe)

Changes Made

1. Configurable PAR Request Expiry (feat(config))

• Added parRequestExpiry property (default: 600s) to OAuth2ServerProperties.OAuth2TokenProperties with full Javadoc and RFC 9126 reference
• Updated AuthorizationServerAutoConfiguration.parServer() to read PAR expiry from configuration instead of using the hardcoded 90s default
• Configured par-request-expiry: 600 in sample-authorization-server's application.yml

2. Consent Page Loading State UX (feat(ui))

• Added loading spinner and disabled state to Approve/Deny buttons on both aoa_consent.html and oidc_consent.html to prevent duplicate form submissions
• Buttons show a spinner animation and loading text (e.g., "Approving…", "Denying…") after click
• Form action value is preserved via a hidden input before buttons are disabled

3. LLM Operation Policy Rendering Optimization (feat(aoa))

• Simplified QwenLlmOperationTextRenderer system prompt from a 3-section structured output to a concise 1–3 sentence plain-language paragraph
• Removed token expiration from the LLM prompt context — the policy renderer now only describes what the Rego policy itself permits or restricts
• Updated LLM model from qwen3-coder-flash to qwen3-coder-plus for higher quality rendering
• Updated unit tests to match the new simplified output format

4. Documentation Update (doc(README))

• Updated IETF Draft link from draft-liu-agent-operation-authorization-00 (GitHub XML) to draft-liu-agent-operation-authorization-01 (official IETF Datatracker) in both README.md and README.zh-CN.md

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing completed
• All existing tests pass

Test Instructions:

# Run all unit tests (114 tests, all passing on JDK 17)
mvn test -pl open-agent-auth-core,open-agent-auth-framework,open-agent-auth-spring-boot-starter,open-agent-auth-mcp-adapter

Checklist

• Code follows coding standards
• Self-review performed
• Documentation updated
• No new warnings
• Tests added/updated
• All tests pass locally
• CHANGELOG.md updated

Breaking Changes

None. The PAR expiry default is changed from 90s to 600s, but this is a configuration-level change that improves compatibility with real-world authorization flows. Existing deployments can override via open-agent-auth.capabilities.oauth2-server.token.par-request-expiry.

Additional Context

Commits:

• f4c32b8b — doc(README): update agent operation authorization IETF Draft link
• e9d3d9ea — feat(aoa): optimize policy operation render rules in the agent operation authorization consent page
• 1921afb7 — feat(aoa): remove token expiration from operation policy text
• 07d3adb7 — feat(ui): add loading disable button after authorization operation
• b686b29b — test: fix unit test
• e5861ba3 — feat(config): make PAR request expiry configurable

[github-actions]

Code Coverage Report

Overall Project	85.15% -0.01%	🍏
Files changed	86.67%	🍏

Module	Coverage
open-agent-auth-spring-boot-starter	87.53% -0.03%	🍏
open-agent-auth-spring-boot-starter	87.53% -0.03%	🍏
open-agent-auth-spring-boot-starter	87.53% -0.03%	🍏
open-agent-auth-spring-boot-starter	87.53% -0.03%	🍏
open-agent-auth-spring-boot-starter	87.53% -0.03%	🍏
open-agent-auth-spring-boot-starter	87.53% -0.03%	🍏

Files

Module	File	Coverage
open-agent-auth-spring-boot-starter	OAuth2ServerProperties.java	98.61% -1.39%	🍏
	AuthorizationServerAutoConfiguration.java	79.95%	🍏
open-agent-auth-spring-boot-starter	OAuth2ServerProperties.java	98.61% -1.39%	🍏
	AuthorizationServerAutoConfiguration.java	79.95%	🍏
open-agent-auth-spring-boot-starter	OAuth2ServerProperties.java	98.61% -1.39%	🍏
	AuthorizationServerAutoConfiguration.java	79.95%	🍏
open-agent-auth-spring-boot-starter	OAuth2ServerProperties.java	98.61% -1.39%	🍏
	AuthorizationServerAutoConfiguration.java	79.95%	🍏
open-agent-auth-spring-boot-starter	OAuth2ServerProperties.java	98.61% -1.39%	🍏
	AuthorizationServerAutoConfiguration.java	79.95%	🍏
open-agent-auth-spring-boot-starter	OAuth2ServerProperties.java	98.61% -1.39%	🍏
	AuthorizationServerAutoConfiguration.java	79.95%	🍏