OAuth 2.0 for iOS in 2026: PKCE, PAR, DPoP, and JAR

PKCE was 2015's OAuth hardening for mobile. PAR, DPoP, and JAR are 2026's. What each fixes, when to use which, and how they compose for regulated iOS apps.