Oauth Authorize Get

Entry point of the authorization flow, hit by the MCP client's system browser. Pure redirect logic, no HTML: client_id and redirect_uri are validated before anything else (redirecting to an unvalidated URI would be an open-redirect vulnerability); every other problem is reported by redirecting back to redirect_uri with an error parameter (RFC 6749 §4.1.2.1). On success, hands off to static/oauth.html (login + consent UI) with the same params.