Implement SEP-837: Update authorization spec to clarify client type requirements

This is a tracking issue for implementation of SEP-837.

Status — SEP-837 (Client type requirements — DCR `application_type`)

Track: C — independent, starts now.
Spec: seps/837-client-type-requirements.md (numbered SEP-837)

Nothing in main — no application_type in DCR request body. git grep -n "application_type" returns no hits in packages/.
No open or closed PRs in the SDK reference SEP-837.

R-837-1 (wire): Client MUST specify application_type during Dynamic Client Registration
R-837-2 (sdk): Native applications SHOULD use application_type: "native" (localhost / custom-scheme redirect)
R-837-3 (sdk): Web applications SHOULD use application_type: "web" (https non-local redirect)
R-837-4 (wire): Client MUST be prepared to handle DCR rejection due to redirect-URI constraints (typed error, not crash/loop)
R-837-5 (sdk): On registration rejection, client SHOULD surface a meaningful error including the AS error code/description

In packages/client/src/client/auth.ts, the DCR request body construction:
- infer application_type from the configured redirect_uri (custom scheme or loopback → "native"; https non-local → "web"); allow explicit override on OAuthClientProvider
Map invalid_redirect_uri / invalid_client_metadata responses to a typed DcrRejectedError carrying the AS error fields
Tests: native redirect → native; https → web; rejected → typed error surfaces description

feat(client,core): application_type client metadata with native/web i…