Authenticate

Exchange authorization code for access token with PKCE and CSRF validation.

For local auth environments, the 'code' field contains the user's email and authentication generates a synthetic bearer token locally.