Initial commit: OAuth IAM Laravel application

Laravel-based OAuth/IAM service with Passport, Vue 3 frontend, and
Docker Compose setup for local and production deployment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/Http/Controllers/Api/AuthorizedAppController.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controllers\HasMiddleware;
+use Illuminate\Routing\Controllers\Middleware;
+use Laravel\Passport\Http\Middleware\CheckToken;
+use OpenApi\Attributes as OA;
+
+class AuthorizedAppController extends Controller implements HasMiddleware
+{
+    public static function middleware(): array
+    {
+        return [
+            new Middleware(CheckToken::using('account:read'), only: ['index']),
+            new Middleware(CheckToken::using('account:write'), only: ['destroy']),
+        ];
+    }
+
+    #[OA\Get(
+        path: '/authorized-apps',
+        summary: 'Listar apps de terceros a las que le diste acceso a tu cuenta',
+        security: [['oauth2' => ['account:read']]],
+        tags: ['Account'],
+        responses: [new OA\Response(response: 200, description: 'Listado de tokens/apps autorizadas')]
+    )]
+    public function index(Request $request)
+    {
+        $user = $this->requireUser($request);
+
+        $tokens = $user->tokens()
+            ->where('revoked', false)
+            ->with('client')
+            ->get()
+            ->reject(fn ($token) => $token->client->revoked || $token->client->hasGrantType('personal_access'))
+            ->values();
+
+        return response()->json($tokens);
+    }
+
+    #[OA\Delete(
+        path: '/authorized-apps/{tokenId}',
+        summary: 'Revocar el acceso de una app de terceros',
+        security: [['oauth2' => ['account:write']]],
+        tags: ['Account'],
+        parameters: [new OA\Parameter(name: 'tokenId', in: 'path', required: true, schema: new OA\Schema(type: 'string'))],
+        responses: [
+            new OA\Response(response: 204, description: 'Acceso revocado'),
+            new OA\Response(response: 404, description: 'No existe o no es tuyo'),
+        ]
+    )]
+    public function destroy(Request $request, string $tokenId)
+    {
+        $token = $this->requireUser($request)->tokens()->where('id', $tokenId)->first();
+
+        abort_unless($token, 404);
+
+        $token->revoke();
+        $token->refreshToken?->revoke();
+
+        return response()->noContent();
+    }
+
+    private function requireUser(Request $request): User
+    {
+        return $request->user('api') ?? abort(422, __('messages.self_service_requires_user'));
+    }
+}