Register a client

RFC 7591 dynamic registration, unauthenticated by necessity: a stranger's assistant cannot connect if registration requires a credential it does not yet have.

A client_id is an identifier and never an authorisation. It grants nothing until a human approves a consent screen, so the only things enforced here are the ones that protect that screen and the redirect: an acceptable redirect_uri (https, or http on a loopback address per RFC 8252, and no fragment), a display name that cannot lie (control characters stripped, length capped), and a per-address rate limit so the table cannot be grown without bound.

No client secret is issued. Requests asking for one, or for an unsupported grant, are refused here rather than silently downgraded.