When the discovered AS metadata omits the optional `registration_endpoint`, `create_client_registration_request` still falls back to the resource origin's `/register`, yet the new gate (`oauth_metadata is not None`) stamps the PRM-advertised issuer on that fallback registration — so the new comment's guarantee that "the registration request below actually targets that issuer's registration_endpoint" doesn't hold on this path. Non-blocking nit (the runtime behavior here is unchanged from before t