ChatGPT's client metadata document declares private_key_jwt but supports none #380

https://chatgpt.com/oauth/client.json sets token_endpoint_auth_method private_key_jwt and lists none in token_endpoint_auth_methods_supported; Conderis CIMD accepts a document as a public PKCE client when either names none.

CIMD (#378) lives in src/Conderis/Services/Identity/ClientMetadataDocuments.cs: a middleware before UseAuthentication handles GET /oauth/authorize with an https client_id URL (default port, DNS host, non-root path), fetches the document via the named HttpClient 'cimd' (SocketsHttpHandler ConnectCallback allows public IPs only, no redirects, 16 KB, 5 s timeout, 20 fetches/min per remote IP, 5-minute reuse per client_id), validates it with OAuthEndpoints.ReadClientMetadata(documentClientId) and upserts an OpenIddict public application with ClientId = URL. Tests stub the 'cimd' client via WithWebHostBuilder + ConfigurePrimaryHttpMessageHandler. Discovery advertises client_id_metadata_document_supported and does not offer private_key_jwt, so ChatGPT falls back to none. Verified live on 2026-10-05: authorize with ChatGPT's client_id redirects to /login.