OAuth2 authorization endpoint (authorization_code, PKCE)

Auto-approves a demo user and returns an authorization code. With redirect_uri it 302-redirects with ?code&state; without one it renders a copyable code.