Index: src/server.js
===================================================================
--- src/server.js	(revision df9da7d9ec47d8315b02a66e91f83981cca409d8)
+++ src/server.js	(revision dd568e79b476d730bac4264e3e6d0bab5cfb9753)
@@ -59,4 +59,5 @@
 import ogRoutes from './routes/og.js';
 import apRoutes from './routes/activitypub.js';
+import oauthRoutes from './routes/oauth.js';
 import { apWants, startDeliveryWorker, selfHealTimeline } from './services/ActivityPubService.js';
 
@@ -282,4 +283,7 @@
 // ActivityPub: WebFinger + /ap/* (site-agnostic, resolves the site by slug).
 app.use(apRoutes);
+// ActivityPub C2S: OAuth 2.0 (native/web clients). Site-agnostic; the consent
+// screen picks which site the token can post as.
+app.use(oauthRoutes);
 
 // Themed OG cards (/og/:slug.png) — resolve the site by slug themselves, so they