feat: implement dynamic client registration

[Zaimwa9]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Closes #7033

Implements POST /o/register/ for DCR OAuth Dynamic Client Registration to enable MCP clients to self-register their application.

• Added DCR endpoint that
  • accepts client_name and redirect_uris
  • creates a public DOT Application
  • returns a client_id
• Redirect URI validation: HTTPS required (localhost/127.0.0.1 exception), no wildcards, no fragments, max 5 URIs
• XSS on consent screen protection with client name sanitisation
• Dedicated DCR_THROTTLE_RATE throttle scope at 10/min per IP
• RFC 7591 compliant error responses (error + error_description format)
• Daily recurring task to clean up stale applications (registered > 14 days ago, never used)

How did you test this code?

https://www.loom.com/share/8f821fda00cd48cbbc4673a509047364

1. Start the dev server: make docker-up django-migrate && make serve
2. Register a client:

curl -s -X POST http://localhost:8000/o/register/ \
  -H 'Content-Type: application/json' \
  -d '{"client_name": "OAuth Test Server", "redirect_uris": ["http://localhost:3000/oauth/callback"]}' \
  | python3 -m json.tool

3. Update CLIENT_ID in api/oauth2_test_server.mjs with the returned client_id
4. Run node api/oauth2_test_server.mjs and open http://localhost:3000
5. Log in via the Django admin page, then authorise the application on the consent screen
6. Verify the token response is returned (access_token, refresh_token, scope: mcp)

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, reopen this pull request to trigger a review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 8, 2026 8:16am
flagsmith-frontend-preview	Ready	Preview, Comment	Apr 8, 2026 8:16am
flagsmith-frontend-staging	Ready	Preview, Comment	Apr 8, 2026 8:16am

The base branch was changed.