Oauth Approve

Deprecated by #3722: /oauth/authorize no longer renders a token-paste form, so nothing legitimate POSTs here anymore — approval is native-tray-only, via POST /oauth/tray-approve, which carries its own nonce (F-06's only auth-code emitter; unaffected by this route). Any request that still reaches this route predates that removal (a stale cached tab, a bookmark) and gets this explicit message instead of the old PKCE 400: the removed form's hidden fields never included code_challenge_method, so every real submit used to fail with the misleading "Only PKCE S256 is supported" — the bug #3722 was filed over. Checked: neither web/app/oauth/approve/route.ts (a pure proxy) nor mac-swift/go-server post here — see #3722's PR for the sweep.