Documents under C-5 why oAuthClientOverride counts only in bootstrap and recovery mode, and adds tests/e2e/client_override.py: the recovery administrator keeps the override in both modes; after setup, an administrator gets no code for an unregistered client or a redirect URI its client didn't register, and a device code approved for an unregistered client can't be exchanged. The script fails against a build without the change (3 of 8) and passes with it.