App MCP authorization request

OAuth 2.1 authorization endpoint (PKCE S256 only). scope is tools, optionally with openid, email, profile (and offline_access); nonce (1-255 characters) is echoed in the id_token. A loopback http redirect_uri matches its registration on any port (RFC 8252 §7.3). A signed-out user is sent to the release's site.sign_in_path (else the hosted /auth/sign-in) with returnTo, and back; a signed-in user sees a consent page. An unknown client or unregistered redirect_uri gets an error page and is never redirected.