RFC 7591 dynamic client registration, open and unauthenticated.

Open registration is what MCP clients require: they have no way to be issued a client_id out of band, and refuse to start the flow without this endpoint. It grants nothing on its own -- no secret is issued, the caller still has to walk a human through Google sign-in on the consent page, and every redirect_uri offered here is held to the same host allowlist the authorize endpoint enforces. So the worst a stranger can register is a callback that was already allowed to receive codes.