Begin authorization

Validates the request, stores it under an opaque id, and redirects the browser to the first-party consent screen at /oauth/consent/{id}.

Two failure classes, deliberately answered differently. If the client_id is unknown or the redirect_uri is not an exact match for a registered value, the browser is shown an error page — never a redirect. Redirecting to an unvalidated URI is how an authorization server becomes an open redirector. Once the redirect target is validated, everything else (response_type, PKCE) is returned to the client as an OAuth error on that URI.

redirect_uri is compared as an exact string. Prefix matching is how https://app.example.com/cb becomes https://app.example.com/cb.evil.