Create a client credential.

Provisions a new confidential OAuth client owned by the authenticated user. Unlike Dynamic Client Registration (which stays public/PKCE-only), this creates a secret-bearing client for a user who has already signed in with an external identity provider in the route organization.

The response carries the client_id and metadata. The generated client_secret is shown only at creation time and cannot be recovered later, so it must be stored by the caller.