Oauth Authorize Post

Process authorization consent.

OAuth2 params (client_id, redirect_uri, etc.) must be in query string, not in POST body. This is required by Authlib 1.6.5 which generates payload from query params for authorization endpoint.

Issue #1752: the user is emailed a security notice once the authorization code is stored, when the consent grants the client something new — a first authorization, a scope the user has not granted it before, or a client changed (name, redirect URIs, scope) since the user's last grant. An unchanged repeat consent adds little: the code can only reach the client's registered redirect URI.