Single-workspace hosts allow creating user-scoped OAuth clients that can never be used

[RhysSullivan]

On local/desktop (single org workspace, real LOCAL_SUBJECT), oauth.clients.create accepts owner: "user" clients, but every local connection is org-scoped, so those clients are categorically unusable. The guard then rejects them with cloud vocabulary ("A Workspace connection must use a Workspace app.") on a host that has no Workspace concept.

Fix is either refusing/clamping user client ownership on single-workspace hosts or rewording per host. Split from #1330 (part 3 residual).

[Adityakk9031]

Looking into this now! Investigating the OAuth client owner constraints on single-workspace hosts (local/desktop) to ensure unusable user-scoped clients are either refused or clamped to org scope with host-appropriate error messaging.

[Adityakk9031]

Opened PR with the fix: #1854