Oauth Authorize Post

Consent-allow submit.

Same query parameters as the GET; the consent UI forwards them verbatim. Cookie-bound to the OAuth session, so anonymous POSTs are 401’d up-front.

Response is JSON { redirect_to } instead of a 302 because the caller is a fetch() from the consent UI — we want the UI to perform window.location.href = ... itself rather than have fetch follow the redirect (and lose its cookie context).