Base class for provider-specific OAuth dispatch.
Subclasses override matches plus whichever of client_metadata
and run_login they customize. The default implementations cover
the spec-compliant Authorization Code + PKCE + Dynamic Client
Registration path.
