Registers a custom MCP client (RFC 7591 shape) for anything not on the curated vendor list. This used to be an anonymous endpoint (McpOAuthController.Register) - open, unauthenticated Dynamic Client Registration is what the RFC describes, but it turned out to be a phishing vector: an anonymous caller could mint a client under any client_name and HTTPS redirect_uri, then send a victim a same-domain connect/mcp/authorize link before the victim ever intended to connect anything. Requiring the caller's own bank session first means a client can now only ever be created by someone already authenticated as themselves - it costs the fully anonymous, self-registering client flow the RFC describes, but nothing today depends on that.