Issue access tokens.

Form Parameters (authorization_code grant): grant_type: Must be 'authorization_code' code: Authorization code from /authorize redirect_uri: Must match original request client_id: OAuth client identifier code_verifier: PKCE code verifier

Form Parameters (refresh_token grant): grant_type: Must be 'refresh_token' refresh_token: Valid refresh token client_id: OAuth client identifier

Returns: JSON response with access_token (JWT), refresh_token, expires_in, etc.