The /auth/init route was passing the downstream app's callback URL (e.g. https://md.bkb.cx/api/auth/callback) as the OAuth redirect_uri to @atproto/oauth-client. This is wrong -- the PDS must redirect back to ATAuth's own callback, not the downstream app. Now generateAuthUrl accepts a separate appRedirectUri parameter that is stored in the OAuth state for post-auth redirect, while the OAuth redirect_uri defaults to ATAuth's registered callback.