GetAllowedOAuthClientCredentials ignores the requested client #53

File: core/csharp/MicroZen.Api/Services/ClientsGrpcService.cs:66-78

What this is: Meant to return the OAuth2 credentials a given client is allowed to use.

Problem: The query does SelectMany(c => c.AllowedClientOAuth2Credentials) across all clients and never filters by request.Id. It returns every allowed-credential row in the database. Also allowedCredentials is null can never be true for a ToListAsync() result, so the not-found path is dead.

Fix: Filter .Where(c => c.Id == request.Id) before SelectMany; drop the null check or replace it with a .Count == 0 check.

If we skip it: Cross-tenant leak of OAuth2 credentials, plus a useless branch.