RFC 7591 dynamic client registration intake — Plug.Conn-free orchestrator.

Pipeline:

1. Precondition gate — when server_policy.registration_policy == :initial_access_token and iat == nil, reject with %Error{code: :invalid_token, field: :iat, reason: :missing} BEFORE any other step.
2. IAT redemption via Lockspire.Protocol.InitialAccessToken.redeem/1 (skipped if iat is nil).
3. DCR policy resolution via Lockspire.Protocol.DcrPolicy.resolve/3.
4. Intake validation for JWKS coherence, redirect URIs, and the PKCE floor.
5. Credential generation (client_id, an auth-method-appropriate optional client_secret, and registration_access_token).
6. Persistence via the internal DCR-aware lifecycle helper (DCR-aware persistence helper — preserves provenance/RAT-hash/IAT-FK/issued_at/expires_at verbatim while keeping protocol orchestration independent of operator delivery).
7. Post-commit audit + telemetry emission (:dcr_registration_succeeded / :dcr_registration_rejected).

To prevent IAT enumeration, redemption failures collapse to %Error{code: :invalid_token} (the discriminator stays in telemetry).