Allow OAUTH2 resource-server auth without requiring dummy client registration

Is your proposal related to a problem?

When auth.type=OAUTH2 is set and the goal is purely bearer/resource-server JWT auth (e.g. exposing /mcp/sse to non-interactive service/agent clients, no browser login involved at all), kafka-ui still refuses to start unless at least one auth.oauth2.client.* registration is configured too.

OAuthSecurityConfig.clientRegistrationRepository():

if (registrations.isEmpty()) {
  throw new IllegalArgumentException("OAuth2 authentication is enabled but no providers specified.");
}

This forces operators who only want machine-to-machine/bearer access to also configure a full, working dummy OAuth2 login client (client-id, secret, authorization/token/userinfo/jwk-set URIs) purely to satisfy this startup check — even though that client is never actually used by anyone.

Describe the feature you're interested in

Allow auth.type=OAUTH2 to start successfully with only auth.oauth2.resource-server configured and zero auth.oauth2.client.* entries. The interactive oauth2Login part of the filter chain could simply be skipped when there are no client registrations and a resource-server config is present.

Describe alternatives you've considered

Configuring a dummy/unused client registration as a workaround — works, but adds confusing, unused config that looks like a real login provider.

Version you're running

kafbat/kafka-ui:v1.5.0 and :main

Additional context

Hit this while setting up bearer-token auth for the MCP server (/mcp/sse) for a non-interactive AI-agent use case. Happy to help test a fix.