Self-registered OAuth clients capped at read-only

Fixed

• Dynamic Client Registration is now capped at read-only — OAuth clients that self-register (MCP tools, agent frameworks) receive at most identity and read scopes and are issued a public PKCE client with no client secret; write and admin access remain available only to operator-provisioned first-party clients.