No response from the /oauth2 route tree set Cache-Control at all, so an
intermediary cache or customer-operated reverse proxy was free to apply a
heuristic freshness lifetime to a response carrying a live credential. RFC
6749 §5.1 and OAuth 2.1 §3.2.3 both make an affirmative no-store directive
a MUST for the authorization server.

Add httpmw.NoStore, mounted once on the /oauth2 tree, setting
Cache-Control: no-store and Pragma: no-cache on every response from it.
RFC 6749 §5.1 makes both headers a MUST in a single sentence; OAuth 2.1
drops Pragma because RFC 9111 §5.4 deprecates it as a request-only field,
so sending both is conformant under either reading.

The scope is the whole tree rather than only POST /oauth2/tokens. With a
middleware the mount point is one line either way, and the wider scope
also covers DCR registration (returns client_secret and
registration_access_token), client configuration read and update, and the
authorize endpoint's 302 whose Location query carries the authorization
code. A route added to the tree later inherits the headers with no action
from its author. Three write paths in the tree never call httpapi.Write,
so a fix centralized there would have missed POST /oauth2/revoke, DELETE
/oauth2/clients/{client_id}, and writeOAuth2RegistrationError.

The two /.well-known/* metadata endpoints are deliberately excluded. They
sit on their own route trees, their content is public discovery metadata,
and RFC 9728 §5 asks for the opposite treatment. A negative assertion
pins the exclusion so a later move to a higher router fails CI.

Note for PLAT-498: DELETE /oauth2/tokens now carries no-store and is
wrapped in apiKeyMiddleware, which runs after this middleware. A
Cache-Control write there must not replace no-store with a weaker
directive such as private.

POST /api/v2/oauth2-provider/apps/{app}/secrets returns
OAuth2ProviderAppSecretFull.ClientSecretFull in plaintext, and nothing on
that tree set a cache directive. It meets RFC 6749 5.1's predicate as
squarely as anything under /oauth2, so mount httpmw.NoStore there too
rather than leaving the rule a description of one URL prefix. Mounted
after apiKeyMiddleware, so a 401 that carries no credential gets no
headers, matching the property the /oauth2 tree already has with the
experiment gate.

Also address review comments on the original change. Drop the two
single-use header-name constants in favor of the package's existing
string literals at the call site. Delete the comments that restate the
syntax beside them, in the mount chain, the NoStore godoc, and the test
table. Note why chi's middleware.NoCache is not used: it strips
ETag-family headers from the request, and it sends directives neither
specification asks for while OAuth 2.1 narrows the requirement.

Narrow two overclaiming docstrings. TestNoStoreAfterExperimentGate
builds its chain in the test body, so it does not detect a reordering in
coderd.go, and the docstring no longer says it pins one. The
.well-known assertions prove the exclusion of this middleware, not that
the metadata is cacheable, since those endpoints advertise no freshness
lifetime at all.

The shape annotations on the table entries and subtests ran two to three
sentences where a phrase carried the same fact. Trim them, and trim the
two test docstrings, keeping the clause that says why each shape is under
test: which handlers bypass httpapi.Write, what http.Redirect does to the
header map, why the unmatched-path case does not assert a status.

Case names are unchanged. Renaming them to absorb the comments was
considered and declined, since a name cannot carry the mapping from a
generic handler shape to the real endpoint it models.

The test asserted that RequireExperiment returns 403 and that a
short-circuiting outer middleware stops the inner one from running. The
first belongs to experiments.go and the second is net/http handler
chaining, so nothing in it could fail for a reason involving NoStore.
Reordering the production chain, or replacing NoStore in it with any
no-op, left the test green.

No coverage is lost, because there was none to lose. The experiment
gate that runs in production is RequireExperimentWithDevBypass, which
short-circuits on buildinfo.IsDev(), so the disabled path is not
reachable from a test binary at any level. The design fact the test was
standing in for, that mounting after the gate is deliberate and
harmless, moves to a comment at the mount site.