[madhu-mohan-jaishankar]

Closes #6639

• Validate the iss parameter on the OAuth callback against the authorization server's issuer before the code is redeemed (RFC 9207). Present means exact string match, absent is refused only when the server advertises iss support, no configured issuer means no check.
• On a provider error callback with a mismatching iss, replace the provider's error text instead of showing it.
• Send application_type in dynamic client registration requests. New setting DCR_APPLICATION_TYPE, default auto: native for a loopback redirect URI, web otherwise.
• When a gateway's OAuth issuer changes, deactivate registered clients bound to the old issuer and log a warning if a static client id is carried over unchanged.
• Document the 2026-07-28 authorization profile: what is implemented, the deliberate client-token passthrough for auth type none upstreams, and that Client ID Metadata Documents are a follow-up.
• Tests for each of the above; existing OAuth suites unchanged and passing.