O Auth Client Update

RFC 7591 OAuth 2.0 Dynamic Client Registration. Ordinary Authorization Code clients are tenant-owned and must use PKCE. Only an explicit grant_types: [client_credentials] request provisions a bot account and a separate OAuth client atomically, with client_name as its handle. It requires private_key_jwt and public JWKS. Mixed autonomous and delegated grants are rejected. Delegated private_key_jwt clients create no account. Autonomous clients inherit the bot account's current role permissions. Client credentials token requests without scope receive those permissions; explicit token scopes may narrow them. The optional runtime setting services.oauth.autonomous_registration_role_id assigns an additional role atomically at provisioning; deleted role references are skipped. Autonomous registration is controlled by the runtime setting services.oauth.autonomous_registration_mode: disabled rejects it, protected requires an Initial Access Token in Authorization: Bearer, and open permits it without a token. Supplied tokens must always be valid and authorize autonomous registration only. One use is consumed atomically with successful account and client creation. Invalid metadata or handle collisions do not consume a use. Ordinary DCR does not require an IAT. This endpoint is rate limited. In approval mode, a valid IAT permits immediate registration. Otherwise, autonomous clients must opt in with registration_mode: [approval] and receive 202 with a registration_code and verification challenge. Poll this endpoint with registration_code; metadata supplied on a poll is ignored. Approval returns 201 on a subsequent poll. Early polls return 429 with Retry-After. Denial, expiry, and unknown or consumed codes return 400. Send registration_code and cancel_registration: true to cancel a pending request (204). No account or client exists while approval is pending. Implements draft-dellaert-oauth-approval-based-dcr-00 (experimental).