Authorization endpoint

Validates the request and redirects the browser to the console's consent screen.

PKCE is mandatory. code_challenge and code_challenge_method=S256 are required for every client, public or confidential; a request without them is refused.

Error handling is in two phases, and the order is a security property. A bad or unknown client_id, or a redirect_uri that is not an exact match for one this client registered, is reported DIRECTLY as a 400 — redirecting there would mean redirecting to a URI that just failed validation, which is an open redirect. Every later failure (unsupported_response_type, missing PKCE, invalid_scope) redirects back to the now-validated redirect_uri as ?error=…&error_description=…&state=…, per RFC 6749 §4.1.2.1. Public — no credential. That is not an oversight: a client cannot authenticate before it has a token, which is the entire purpose of this surface.