The owning-application UI tier (ADR-0001) -- this app IS its own OAuth
authorization server (ADR-0001's 2026-10-22 amendment; platform-api
has no role in it). The RFC 7009 consent screen is served by this app's
own backend at /oauth/consent, reached only via a real
/oauth/authorize request carrying a registered client's
client_id/redirect_uri/code_challenge
-- visiting it directly, with no query params, is correctly rejected
("missing or malformed"), not a bug.