OIDC: IPv6 loopback DCR, dedup error redirects + scope labels

Security-review follow-ups on the OIDC flows.

IPv6 loopback redirect_uri in dynamic client registration (RFC 8252):
- valid_redirect_uri? compared URI#host, which returns the bracketed "[::1]"
  for IPv6 literals, so http://[::1]:PORT/... was always rejected. Compare
  #hostname (unbracketed) instead, unblocking IPv6-only native clients.

Extract redirect_authorize_error (removes 12 copies of the boilerplate):
- The authorize/consent flows built the error redirect by hand ~a dozen times
  (error_uri = "...?error=..."; += "&error_description=#{CGI.escape ...}"; +=
  state; redirect_to). One helper now composes the query, and — unlike every
  copy — appends "&error=..." when the redirect_uri already has a query string
  instead of a malformed second "?".

Extract token-endpoint helpers (removes ~80 duplicated lines):
- authenticate_token_client: the identical client-auth preamble shared by the
  authorization-code, refresh, and device-code grants.
- render_token_triple: the access + refresh + id_token mint and RFC 6749 §5.1
  response shared by the authorization-code and device-code grants.

Single source of truth for scope descriptions:
- New OidcHelper#scope_description + shared shared/_scope_list partial, used by
  both the browser consent screen and the device authorization screen; drops the
  scope_labels hash and the hard-coded per-scope blocks that would have drifted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie

app/helpers/oidc_helper.rb

@@ -0,0 +1,16 @@
+module OidcHelper
+  # Single source of truth for the human-readable description of what each OAuth
+  # scope grants. Shown on both the browser consent screen (oidc/consent) and the
+  # device authorization screen (device_authorizations/show) via the shared
+  # shared/_scope_list partial. Unknown scopes fall back to their raw name.
+  def scope_description(scope, user: Current.user)
+    case scope
+    when "openid" then "Verify your identity"
+    when "email" then "Access your email address (#{user&.email_address})"
+    when "profile" then "Access your profile information"
+    when "groups" then "Access your group memberships"
+    when "offline_access" then "Stay signed in (refresh access)"
+    else scope
+    end
+  end
+end