Authorization endpoint (delegated consent)

Browser endpoint for the authorization-code grant (RFC 6749 §3.1). The Solution Provider redirects the seller here; the seller authenticates and consents at Walmart IAM, and the response redirects to `redirect_uri` with a single-use `code`. - **PKCE required** — `code_challenge` + `code_challenge_method=S256` (RFC 7636). `plain` is not accepted. - **Exact** `redirect_uri` match against a value registered for the client. - `state` required; echoed back verbatim (CSRF). - The success and error redirects (performed by IAM) carry `iss` (RFC 9207); clients MUST validate it. **Error handling.** For a valid request, this endpoint `302`-redirects to the Walmart IAM consent URL; IAM then drives consent and performs the RFC 6749 §4.1.2.1 redirect back to the client's `redirect_uri` (success or error), because IAM is the party that can verify the `redirect_uri` is registered. For request-level errors that `authorization-service` itself detects (missing/invalid `client_id`/`redirect_uri`, `response_type` != `code`, `code_challenge_method` != `S256`), it returns a JSON `400` (`AuthorizeError`). It deliberately does **not** redirect these errors to the supplied `redirect_uri`: the proxy has no client registry, so self-redirecting to an unverified URI would be an open redirect. > **Upstream status (ADR-048, pending):** `iss` emission, exact-redirect > enforcement, and server-side rejection of `code_challenge_method=plain` are > IAM / app-store responsibilities not yet fully in place. authorization-service > enforces the request-side invariants it can and redirects valid requests to > IAM; the full guarantee lands when those upstream changes ship.