The authenticated client and how it authenticated.
:client is the opaque host client value returned by :load_client,
:client_id is the OAuth identifier (RFC 6749 §2.2) carried by the
credentials (the Basic/body client_id or the assertion sub). When the
host's optional :client_id callback supplies an identifier, it must agree
exactly with the credential-carried value. Library-produced successful
results therefore always contain a non-empty client_id; the field remains
optional on the public struct for source compatibility. :method is the
RFC 6749 §2.3 / OIDC Core §9 authentication method
(:client_secret_basic, :client_secret_post, :private_key_jwt, or
:none for the public-client path).