Consent Submit

Process the consent form submission. Mints the auth code only on approval.

consent_token is the opaque handle emitted by the callback. It never leaves the state backend as anything more than an ID — the actual consent parameters (user_id, email, scopes, redirect_uri) live server-side and can't be tampered with or captured from browser history/proxy logs.

agent_id is posted only by the §4.4 agent-picker variant (consent_model='agent' clients); it is validated and the scope math recomputed entirely server-side — the browser's selection is never trusted.