Register an app that signs people in [write]

The app signs a person in with the authorization-code flow and PKCE (S256) at the sign-in service, asking for openid plus the scopes registered here and naming this API as the resource. The access token it receives is sent as Authorization: Bearer to this API. It acts as that person in one workspace: a person who belongs to several chooses it when they allow the app, and the app is refused everywhere else (universe_mismatch for another workspace named in X-Universe, not_found for a session outside it). It holds only the scopes they allowed and reaches tasks, sessions, agents, the catalog and whoami. On a session in that workspace it can also send messages and interrupts (POST /sessions/{id}/events, POST /sessions/{id}/interrupt, both write) and follow the live stream (GET /sessions/{id}/stream, read). It stops working as soon as the person removes the app from their account page: the next request is refused, and a stream that is open ends within a few seconds. To move the app to another workspace the person removes its access and allows it again. A new app is unreviewed. A caller may register up to 10 apps. Answers 404 until apps with sign-in are open on the platform, and 503 not_migrated until its tables are in place.