[azmeuk]

Fixes:

• Each request now uses the client of its own session. Before, Authlib kept the first client created in the process, for every user.
• The app no longer fails when the server is set in the environment and no client is configured yet.
• The session is only stored when a request changes it, so concurrent htmx requests do not overwrite each other.

Features:

• The client can be confidential or public, with its token endpoint authentication method.
  Configuring a new client forgets the tokens of the previous one.
• PKCE can be S256, plain or disabled. S256 is the default when the server supports it, or for a public client.
• The authorization form accepts other scopes and extra parameters. It shows a live preview of the request and validates the fields inline.
• The tokens tab shows how the tokens were obtained, and the raw token response.

Part of #2