OAuth 2.1 token endpoint

Exchanges an authorization code (with PKCE) for an access + refresh token, or rotates a refresh token. Accepts client credentials in the form body (client_secret_post / none) or in the Authorization header (Bearer registration token, or Basic auth).