Fixes
/oauth/registernow honorstoken_endpoint_auth_method: "none"(RFC 7591): public clients registering with"none"no longer receive an unusedclient_secret, and the registration response reports the method actually granted. Unrecognized methods still fall back toclient_secret_post, matching the discovery metadata. Contributed by @ityakonbu (#14).- Diagnostic logging across the OAuth flow: every rejection branch of
/oauth/authorizeand/oauth/token(unknown client, redirect_uri mismatch, PKCE failure, expired code, unknown refresh token) now logs why, with received-vs-expected values, so failed connections are debuggable from server logs instead of being invisible. Attacker-controllable values are escaped before logging. Contributed by @ityakonbu (#14).