[ ] POST /oauth/register (RFC 7591) validates and stores the client name and redirect URIs, which must be https or loopback http. The store is a small module plus a named migration. Anything else is refused with a plain error.
[ ] Tests in a new file listed in GATE: one good registration, and three bad ones (an http non-loopback URI, a missing name, an oversized body).
Part of #1615.
Done looks like:
POST /oauth/register(RFC 7591) validates and stores the client name and redirect URIs, which must be https or loopback http. The store is a small module plus a named migration. Anything else is refused with a plain error.