A public client — no secret, no JWKS — running the whole flow in the browser: PAR, the redirect, and a DPoP-bound token exchange.