Implement PKCE support for API applications

### Problem Statement

For client-side only API applications, adding [PKCE]() support and then starting to enforce this would reduce the chances of spamming and unauthorized usage on these apps.

### Solution Brainstorm

Implement [https://oauth.net/2/pkce/]() and then start enforcing it slowly. First for all new API apps, and then for older ones too.

### Product Area

APIs

We want to define a set of [lightweight metrics]() that SDKs can automatically collect for e.g. framework, language or platform, focusing only on signals that **do NOT overlap with Tracing**. Ideally these metrics should give a quick sense of app or runtime health, … while deeper investigation will still rely on traces or profiles.

Examples**:**

* Node.js runtime metrics (e.g., event loop delay, heap usage)
* Prisma-related metrics in Next.js
* Mobile CPU / memory usage to help surface potential ANRs or app hangs

---

**Candidate Metrics (add more below)**

* …

*(please also add ideas, questions or examples in comments)*