feat(08-07): wire repeatable bonfire flags and export client-issuing helpers

- bonfire.wrap registers a Repeatable Flag as a Cobra StringSlice so
  Input.Flags returns every repeated --name=value occurrence in order;
  scalar/bare flags are unaffected (D-19)
- wristband.IssueClientCredentials/RejectRedirectURI export the exact
  random-id/secret/hash and redirect-URI validation RFC 7591
  registration already uses, so the fonoteka:oauth-client operator
  command shares one hash/validation path with DCR (T-08-SECRET-TIMING)

bonfire/root.go

@@ -63,6 +63,22 @@ func wrap(c Command, out Output) (*cobra.Command, error) {
 		},
 	}
 	for _, flag := range c.Flags {
+		if flag.Repeatable {
+			// D-19: an ordered, multi-occurrence string flag (Cobra
+			// StringSlice), read back through Input.Flags. Default is a
+			// single-element slice only when non-empty, matching the
+			// scalar path's zero-value convention.
+			var def []string
+			if flag.Default != "" {
+				def = []string{flag.Default}
+			}
+			if flag.Shorthand != "" {
+				cmd.Flags().StringSliceP(flag.Name, flag.Shorthand, def, flag.Description)
+			} else {
+				cmd.Flags().StringSlice(flag.Name, def, flag.Description)
+			}
+			continue
+		}
 		if flag.Shorthand != "" {
 			cmd.Flags().StringP(flag.Name, flag.Shorthand, flag.Default, flag.Description)
 		} else {