Fix OAuth Errors on AWS Cognito

Cognito app clients differ for public SPAs vs confidential backends. Public clients must use PKCE; confidential clients need a secret that never ships to browsers. Hosted UI return URLs must match the domain allowlist character-for-character.

Custom domains add another TLS and redirect layer—verify both the user pool domain and the custom domain settings. OAuthFixer helps decode invalid_grant coming from Cognito’s token endpoint.