adds an iOS cookie-preservation test to the OAuth authorize endpoint, as ASWebAuthenticationSessions on iOS sometimes strip cookies during redirects, which may break the authorization flow.
when an iPhone user-agent is detected without an existing device session or passed cookie test, it enters a test flow. the test flow then sets a session cookie (cookie-test=testing) and does a form-based GET redirect (not a 303 redirect, which iOS of course strips cookies on) back to the same authorize endpoint with redirect-test=1. form submits via javascript to preserve cookies. if the cookie survives, we mark the browser as passing and continue normally. else, on the first failure we show a "please enable cookies" page with a retry link (w/ query param redirect-test=2), and on the second failure, we just return an OAuth error (ERR_COOKIES_UNSUPPORTED) back to the client via redirect, or a frontend error page if no request_uri is available. Also added a request! macro, which wraps all return paths to attach the Set-Cookie header if a success cookie was generated during the test.