GET /api/oauth/client[/:id] returned client_id: undefined (ORM toJSON
strips non-schema fields), breaking the theta-env bootstrap's rotate
path with a 500. get() now emits an explicit public toJSON (omitting
client_secret_hash) and 404s cleanly on unknown ids.