RFC 7591 Dynamic Client Registration — public, self-serve.

RFC 7591 Dynamic Client Registration — public, self-serve.

A remote MCP client (claude.ai / ChatGPT « custom connector ») POSTs its
metadata (``redirect_uris``, ``grant_types``, ``token_endpoint_auth_method``,
``client_name``, ``scope``) and receives a ``client_id`` (+ ``client_secret``
for confidential clients). It then runs the standard Authorization Code +
PKCE flow.

Guard-rails (see ``oauth_service.register_dynamic_client``) :
- Public clients keep PKCE S256 mandatory (enforced at code issuance).
- ``admin`` scope is NOT grantable via DCR (read/write/openid/profile only).
- Rate-limited (10/hour/IP) + global cap of self-registered clients.

Errors follow the RFC 6749 §5.2-style shape
(``{"error": "invalid_redirect_uri", "error_description": …}``) via
``@oauth_rfc6749_errors`` — that's what RFC 7591 §3.2.2 clients expect.