more oauth fixes for hold and appview

cmd/appview/serve.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"html/template"
 	"net/http"
@@ -201,6 +202,20 @@ func serveRegistry(cmd *cobra.Command, args []string) error {
 	mux.HandleFunc("/auth/oauth/authorize", oauthServer.ServeAuthorize)
 	mux.HandleFunc("/auth/oauth/callback", oauthServer.ServeCallback)
 
+	// OAuth client metadata endpoint
+	mux.HandleFunc("/client-metadata.json", func(w http.ResponseWriter, r *http.Request) {
+		// Get the client config from the OAuth app
+		config := oauth.NewClientConfig(baseURL)
+		metadata := config.ClientMetadata()
+
+		// Serve as JSON
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		if err := json.NewEncoder(w).Encode(metadata); err != nil {
+			http.Error(w, "Failed to encode metadata", http.StatusInternalServerError)
+		}
+	})
+
 	// Note: Indigo handles OAuth state cleanup internally via its store
 
 	// Mount auth endpoints if enabled
@@ -227,6 +242,7 @@ func serveRegistry(cmd *cobra.Command, args []string) error {
 		fmt.Printf("  - Device Auth: /auth/device/token\n")
 		fmt.Printf("  - OAuth:       /auth/oauth/authorize\n")
 		fmt.Printf("  - OAuth:       /auth/oauth/callback\n")
+		fmt.Printf("  - OAuth Meta:  /client-metadata.json\n")
 	}
 
 	// Create HTTP server