OAuth 2.0 token endpoint (client_credentials grant)

Exchange client credentials for a short-lived access token.

Request (application/x-www-form-urlencoded): grant_type=client_credentials&client_id=...&client_secret=...

Returns a signed JWT carrying the client's granted scopes.