The federation auth blueprint is mounted at /auth, so the authorize endpoint is /auth/oauth/authorize, not /oauth/authorize. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- OAuthCode model + migration for authorization code flow - OAuth client blueprint (auto-registered for non-federation apps) - Per-app first-party session cookies (fixes Safari ITP) - /oauth/authorize endpoint support in URL helpers - account_url() helper + Jinja global - Templates: federation_url('/auth/...') → account_url('/...') - Widget registry: account page links use account_url Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
