Register a public OAuth client (RFC 7591 fallback)

Registrations with no approved grant expire after 24 hours. Restart registration if setup expires. Approved clients do not expire through this cleanup policy. Client names are self-asserted and unverified. Public and rate-limited. Registers a public PKCE and/or device-flow client for MCP/A2A gateways that do not support Client ID Metadata Documents. A device-only registration may omit redirect_uris and use an empty response_types array. No client secret is issued.