Describe Authorization Request

What the consent page needs to render: who is asking, and for what.

Deliberately unauthenticated: the page calls this before it knows whether anyone is signed in, and it reveals nothing secret — only a client name the client chose for itself. Validating here means an invalid request is caught BEFORE the user logs in, rather than after.

client_kind tells the page how to present the requester: for cimd the proven client_host is the identity and client_name secondary; for dcr everything is self-asserted and the page warns. Because this endpoint has no user, the DCR opt-in cannot be checked here — the page checks oauth_dcr_enabled after sign-in for the explanation, and POST /api/oauth/authorize is where it is enforced.