Renders /authorize?client_id=&redirect_uri=&state=&code_challenge=&nonce=. A signed-out visitor signs in first and comes back. The page names the instance asking (GET /api/oauth/clients) and what it will receive; once the user continues, or at once if they already did before, it gets a code (POST /api/oauth/codes) and goes back to the instance with it. An account that itself comes from another instance can't be used from here.