Single-workspace hosts allow creating user-scoped OAuth clients that can never be used

[RhysSullivan]

On local/desktop (single org workspace, real LOCAL_SUBJECT), oauth.clients.create accepts owner: "user" clients, but every local connection is org-scoped, so those clients are categorically unusable. The guard then rejects them with cloud vocabulary ("A Workspace connection must use a Workspace app.") on a host that has no Workspace concept.

Fix is either refusing/clamping user client ownership on single-workspace hosts or rewording per host. Split from #1330 (part 3 residual).

[Adityakk9031]

Looking into this now! Investigating the OAuth client owner constraints on single-workspace hosts (local/desktop) to ensure unusable user-scoped clients are either refused or clamped to org scope with host-appropriate error messaging.

[Adityakk9031]

Opened PR with the fix: #1854

[The-AarushiSingh]

Hey @RhysSullivan! #1894 is up for this.

Kept it small: local (subject === "local") now rejects owner: "user" instead of writing a client that can never be used. Cloud / multi-workspace subjects are untouched. Also swapped the “Workspace app” mismatch line for a plain org/org message.

Happy to change the copy, move the check, or switch to clamp if you’d rather that. Just say which direction you want.