Changes to Validate a `callback_url` against the deployment's OAuth PKCE policy without issuing a code. The consent UI calls this on mount and refuses to render if the URL is rejected — closing the gap where a "Deny" click could otherwise redirect to a host the operator denied.