- Add wf_oauth_client_id_is_loopback() to recognize http://localhost client IDs per the atproto convention (optional ?scope= and &redirect_uri= query params, no path or fragment). - Add wf_oauth_loopback_client_metadata_get() to construct client metadata locally instead of fetching a metadata document, matching the reference provider behavior. - Add wf_oauth_query_value_dup() to decode scope/redirect_uri values (handles + as space and %XX via curl_easy_unescape, copies into malloc-owned storage so wf_oauth_client_metadata_free can use free()). - Treat loopback client IDs as valid in wf_oauth_client_id_valid() before falling through to the https-only URL check. - Add test_loopback_client() covering bare origin, custom scope, custom redirect_uri, and rejection of fragments/non-root paths.