Disable "WebView detection" for Back-Channel calls

Apply embedded WebView detection only to the authorization endpoint (/oauth/authorize), not to /oauth/token or other back-channel endpoints (e.g., /oauth/jwks). The token exchange must not be blocked based on the user agent.

RFC8252 OAuth for Native Apps (simple_oauth_native_apps)

Start by tracing the embedded WebView detection path for /oauth/authorize and compare its handling with /oauth/token and /oauth/jwks. Verify the RFC8252 native-app behavior and test that WebView user agents are checked only at the authorization endpoint, while token and JWKS calls are not blocked.

Written by the indexing model from the issue text.