Using an access token after its consumer is deleted throws a TypeError

Problem/Motivation

Deleting a consumer does not delete its tokens. The oauth2_token.client reference now points to a missing entity, and the next request that uses one of those access tokens fails with a 500:

TypeError: Cannot assign null to property Drupal\simple_oauth\Authentication\TokenAuthUser::$consumer of type Drupal\consumers\Entity\Consumer

TokenAuthUser::__construct() assigns $token->get('client')->entity to a typed Consumer property without checking for NULL. The token still passes JWT validation, because the signature and expiry are fine and the token row exists and isn't revoked.

Simple OAuth already deletes tokens when a consumer is updated (simple_oauth_consumer_update() → TokenExpiryTriggerHandler::handleConsumerUpdate()). Nothing handles delete.

Steps to reproduce

1. Create a confidential consumer with the client_credentials grant and a default user.
2. Request a token: POST /oauth/token with grant_type=client_credentials.
3. Delete the consumer.
4. Request GET /oauth/debug?_format=json with Authorization: Bearer <token>.

Expected: 401. Actual: 500 with the TypeError above.

Proposed resolution

• Implement hook_consumer_delete() and delete the consumer's tokens, mirroring handleConsumerUpdate().
• In TokenAuthUser::__construct(), throw OAuthServerException::invalidClient() when the client reference doesn't load. Sites with tokens already orphaned by past deletes then get a 401 instead of a 500.

Remaining tasks

• MR with a kernel test covering both changes.

AI disclosure

AI-Generated: Yes. I drafted this issue summary with Claude Code and reviewed it before filing.