OAuth apps are stored in the database and managed via a web UI. The UI is terrible (see e.g. T98880 and T103587) but even if it weren't, it doesn't seem the right way to manage apps that we maintain ourselves (such as the Wikimedia mobile apps). Current apps are tied to a wiki username, can be overridden by volunteer OAuth admins, the DB store doesn't easily allow for translations etc.
So alongside the current mechanism, there should be a parallel mechanism which is configuration-based - $wgOAuthInternalConsumers or something like that, that contains an array of consumer / app definitions which are checked during consumer lookups.