Return OAuth authorize errors to redirect_uri per RFC 6749

[eswan18]

Summary

The authorize endpoint previously returned all errors as raw HTTP error pages. This broke client integrations — when a scope was invalid or PKCE was missing, the client application never received a callback and the user saw a plain text error.

Per RFC 6749 Section 4.1.2.1, errors should be returned to the client's redirect_uri as query parameters when the redirect_uri has been validated. This PR restructures the authorize handler into two validation phases:

1. Direct errors (client_id/redirect_uri invalid): Shown to the user directly, since there's no trusted URI to redirect to.
2. Redirected errors (bad response_type, missing PKCE, invalid scope): Sent back to the client as ?error=<code>&error_description=<msg>&state=<state> so the client can handle them.

Changes

• Restructured HandleOauthAuthorize to validate client+redirect_uri first, then redirect subsequent errors
• Added validateOAuthClientRedirect (validates client+redirect only, without scopes) for the early check
• Moved scope validation into the authorize handler so it can use the redirect error path

Test plan

Five integration tests written red/green TDD, covering both error categories:

Errors redirected to client (with error, error_description, state query params):

• Invalid scope → redirects error=invalid_scope
• Missing PKCE → redirects error=invalid_request
• Unsupported response_type → redirects error=unsupported_response_type

Errors shown directly (can't trust redirect_uri):

• Unknown client_id → 400 Bad Request
• Unregistered redirect_uri → 400 Bad Request

Full regression: All 55+ existing tests pass.

Closes #58.

🤖 Generated with Claude Code