Exchange an existing API key for a bearer token (client_credentials).

KEPT, NOT DELETED. Nothing in this repository, the website source or the Figma plugin references it, and the flow it was added for cannot have been completing (its authorization endpoint 404s) -- but "no caller found by static search" is not "usage proven absent", and the auth-scope invariant is explicit that an authentication endpoint other product surfaces might use is not removed on an assumption. Deleting it needs production request-log evidence, which is admin-gated; see docs/audit/anthropic_review_response.md for the exact query.

The empty-bearer defect IS fixed. An anonymous caller posting {} used to receive 200 {"access_token": "", "token_type": "bearer"} -- a token that authenticates nobody, handed out to anyone, and the single worst thing for a reviewer to find on a server submitted as unauthenticated. A caller that was passing a real key is unaffected.