Start an agent authorization (code with PKCE)

The authorization endpoint. A browser is sent here by an agent; the request is validated (the client, the exact redirect URI, S256 PKCE, the scopes, the resource) and the browser is redirected to the console, where a signed in owner or admin sees what the agent asks for and where its code would go, and approves or denies. The authorization code goes to the redirect URI and is exchanged at POST /oauth/agent/token. A request with an unregistered or mismatched redirect URI is refused without redirecting. client_id is a registered client or an https URL of a Client ID Metadata Document.