fix(auth): defer resource binding for dynamic clients

[stefan-ernst]

Summary

• make RFC 7591 registrations resource-neutral instead of binding every public client to /mcp
• let each authorization request select its resource through RFC 8707
• use provider-neutral names and slugs for dynamically registered clients

This enables Docmost to use a per-user public OAuth flow without an MCP audience. Omni is unchanged and continues to send /mcp during authorization, token exchange, and refresh.

Tests

• full internal/handlers overlay suite (passed)
• focused dynamic-registration regression after rebasing onto main (passed)
• Omni Windshift connector: 3 passed
• Omni connector OAuth integration: 5 passed

The matching regression test is on Windshiftapp/core-tests branch feat/docmost-public-oauth.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}