Authorization endpoint (authorization code + PKCE)

Browser entry point of the authorization-code flow. Validates the request, then sends the person to Microsoft sign-in (if needed) and the Presify consent page; on approval the browser is redirected to redirect_uri with code and state. PKCE with S256 is required. A client_id that is an https URL names a Client ID Metadata Document: Presify fetches it (https only, public addresses only, no redirects, at most 5 KB, cached per its Cache-Control), and a document it cannot fetch or validate is treated as an unknown client. An unknown client_id, an unregistered redirect_uri, or any error for a redirect_uri Presify has not verified (anything other than a known AI assistant callback or a loopback address) renders a local error page and never redirects (open-redirect guard); for a verified or loopback redirect_uri, errors redirect back to the client with error and error_description.