[AvianJay]

Fixes the production OAuth error Invalid consent form. Reload the page and try again. when users click Allow or Cancel in a real browser.

The HTML used Referrer-Policy: no-referrer, which makes native form POSTs send Origin: null; the server correctly rejected that origin. After this rejection is fixed, Chromium also blocks the OAuth callback redirect under form-action 'self'.

Use strict-origin for consent/connection-management HTML so POSTs preserve Origin without disclosing URL paths/query parameters. Permit only the transaction's registered callback origin in consent's form-action directive. OAuth redirects still use no-referrer; the exact-origin and cookie/form CSRF checks are unchanged.

Validation:

• Reproduced the original behavior in Chromium: browser-generated Origin: null, HTTP 403.
• Reproduced the independent callback navigation block with self-only form-action.
• 24 focused tests and 4 subtests passed, including real Chromium approval, denial, callback navigation and revocation, wrong/null/missing Origin rejection, CSRF mismatch rejection and CSP delimiter escaping.
• Browser tests use synthetic accounts, temporary SQLite databases and an in-process HTTP bridge, with no real credentials or outbound OAuth requests.
• Added GitHub Actions coverage for these native-browser regressions. Ruff and git diff --check passed.
• Live public authorization-management page currently returns the original problematic headers; the server must restart on this revision to apply the fix.