Build native OAuth client IDs from the bound loopback redirect URI and requested scope set, then use that mode for logins unless explicitly overridden.
The encoding is deterministic and includes the callback's actual port. Authorization-server rejection remains visible and points users to --client-id for a hosted alternative instead of silently falling back.