Starts an OAuth 2.0 authorization code flow with PKCE. Requires client_id, redirect_uri (registered for the client), response_type=code, state and a code_challenge (43-character base64url) with code_challenge_method. resource is optional and defaults to the Wingspan API. When the request is valid, redirects (302) the user agent to the login and consent application. When the request fails validation and the redirect_uri is registered, redirects (302) to that redirect_uri with an OAuth error, state and iss. If no usable redirect exists, returns 400 with an OAuth error body. prompt=none is available only to verified clients; the consent application then completes the request without a consent screen through POST /v3/platform/oauth/authorize-silent-complete.