Document that integrations should expect provider-side abuse controls on OAuth control endpoints and handle 429 responses with retry/backoff semantics.
Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
Andy Dixon