OAuth 2.1 authorization endpoint

Initiates the authorization-code flow (PKCE S256 mandatory). When the user has no active dispatcher session, redirects to the sign-in page — OAUTH_LOGIN_URL when the operator has set it (with return_to=<finalize> appended to that URL's own query), else the pre-#315 GitHub-only bridge (/oauth/github/login?return_to=...) — and resumes via /oauth2/authorize/finalize after the bridge completes (by GitHub callback or, when OAUTH_LOGIN_URL points at a page offering it, email sign-in). On success, redirects the browser to redirect_uri with code and echoed state.