Fix OAuth Errors on Okta

Okta authorization servers scope claims and audiences separately from Auth Server defaults. Mismatched aud or issuer URLs cause obscure failures after the code exchange. Ensure the app integration lists every environment-specific redirect URI.

Org policies may require MFA or device trust before tokens issue—surface those errors distinctly from pure OAuth misconfig. OAuthFixer walks through common Okta error strings.