[codex] support OAuth client id negotiation

[Rabithua]

Summary

• Add client-initiated OAuth client resolution for HTTP MCP authorization.
• Support OAuth Client ID Metadata Document clients and native public reverse-DNS client IDs with private-use redirect URIs.
• Advertise client_id_metadata_document_supported in authorization server metadata and add coverage to OAuth/MCP tests.
• Preserve /oauth/authorize?requestId=... through login so unauthenticated HTTP MCP authorization returns to the consent page instead of /home.

Why

Some MCP/OAuth clients begin authorization with a stable client_id before dynamic registration. Previously those requests failed with invalid_client, including native clients using custom redirect schemes.

Unauthenticated users could also lose the original authorization target during login and land on the app home page, which prevented the OAuth consent step from appearing.

Validation

• cd server && bun run lint
• cd server && bun run build
• cd server && POSTGRESQL_URL=postgresql://rote:rote_password_123@localhost:5433/rote TEST_BASE_URL=http://127.0.0.1:3004 bun run tests/oauth-mcp.test.ts
• cd web && bun run lint
• cd web && bun run build
• Browser smoke: unauthenticated /oauth/authorize?requestId=... redirected to /login?redirect=...; after login it returned to /oauth/authorize?requestId=... and displayed 拒绝 / 允许.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.