Dynamic client registration (RFC 7591)

Register an OAuth client and receive a client_id. MCP clients rely on this: there is no human to fill in a registration form on a developer portal, so registration is open. That is safe because a client_id confers nothing on its own — it cannot be exchanged for a token without a human completing consent.

redirect_uris must be https, or http on a loopback host (localhost, 127.0.0.0/8, [::1]) for a native client per RFC 8252 §7.3. Wildcards and fragments are rejected. A client_secret is issued only when token_endpoint_auth_method is not none, and is returned exactly once. Public — no credential. That is not an oversight: a client cannot authenticate before it has a token, which is the entire purpose of this surface.