registration config defaults; support non-JWT bearer token for client registration; persist client "trusted" property; use `verifyClientRegistration` middleware at register endpoint