feat(auth): offer native OAuth sign-in on servers like matrix.org

The login page looked for an OAuth issuer in .well-known
(m.authentication), which matrix.org no longer publishes, so its users
got the password / SSO compatibility forms. Detect native OAuth the way
the SDK finds the auth server for refresh: load /auth_metadata next to
the login flows. When present:
- Login shows "Continue with <server>" only (as Element does); a legacy
  SSO loginToken coming back from a redirect still completes.
- Register opens the auth server's sign-up page (prompt=create, where
  prompt_values_supported says so) instead of the legacy forms.
Servers without it (Lotus) are unchanged.

Checked against the live servers: matrix.org login and register show
"Continue with matrix.org" and no password form; matrix.lotusguild.org
keeps its password form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

e2e/oauth-sdk44.spec.ts

@@ -11,6 +11,7 @@ import { HS, PASSWORD, api, enc, ensureUser, hsReachable, uniq } from './localHs
 const AUTH = 'https://auth.fake.test';
 
 type Fake = {
+  prompts: (string | null)[];
   registered: number;
   tokenCalls: { grant: string; refresh?: string }[];
   revoked: string[];
@@ -33,6 +34,7 @@ async function synapseToken(localpart: string, deviceId: string): Promise<string
 
 async function fakeOAuth(context: BrowserContext, localpart: string): Promise<Fake> {
   const fake: Fake = {
+    prompts: [],
     registered: 0,
     tokenCalls: [],
     revoked: [],
@@ -73,6 +75,7 @@ async function fakeOAuth(context: BrowserContext, localpart: string): Promise<Fa
         response_modes_supported: ['query', 'fragment'],
         grant_types_supported: ['authorization_code', 'refresh_token'],
         code_challenge_methods_supported: ['S256'],
+        prompt_values_supported: ['create'],
       },
     }),
   );
@@ -107,6 +110,7 @@ async function fakeOAuth(context: BrowserContext, localpart: string): Promise<Fa
       const deviceId = /urn:matrix:client:device:(\S+)/.exec(
         url.searchParams.get('scope') ?? '',
       )?.[1];
+      fake.prompts.push(url.searchParams.get('prompt'));
       expect(url.searchParams.get('response_mode')).toBe('query');
       expect(url.searchParams.get('code_challenge_method')).toBe('S256');
       const code = `code-${Date.now()}`;
@@ -231,4 +235,26 @@ test.describe('OAuth sign-in on SDK 44', () => {
     expect(fake.revoked.sort()).toEqual([latest.accessToken, latest.refreshToken].sort());
     expect(await storedSession(page)).toBeNull();
   });
+
+  test('Register opens the auth server sign-up page (prompt=create)', async ({ context }) => {
+    test.setTimeout(120_000);
+    const user = await ensureUser(uniq('or'));
+    const fake = await fakeOAuth(context, user.localpart);
+    const page = await context.newPage();
+    await page.goto(`/register/${enc(HS)}/`);
+    // Native-OAuth server: no legacy registration form, just the auth server.
+    await expect(page.getByLabel('Username', { exact: true })).toHaveCount(0);
+    await page.getByRole('button', { name: /Continue with/ }).click();
+    await page.waitForURL(/\/home/, { timeout: 60_000 });
+    expect(fake.prompts).toEqual(['create']);
+  });
+
+  test('Login sends no prompt', async ({ context }) => {
+    test.setTimeout(120_000);
+    const user = await ensureUser(uniq('ol'));
+    const fake = await fakeOAuth(context, user.localpart);
+    const page = await context.newPage();
+    await oauthLogin(page);
+    expect(fake.prompts).toEqual([null]);
+  });
 });