Changes to Redeem a one-time authorization code for a RELYING PARTY's own token pair — the back half of the code flow a first-party client on another origin (the Service-Arb panel) runs against `GET /auth/authorize` (publicly `evinvest.ltd/api/auth/authorize`). Called server-to-server by the client's backend, authenticated by its client secret. The code is single-use, lives 60s, and is bound to the client, the exact redirect_uri and the PKCE (S256) challenge sent to authorize; presenting a code twice is refused AND revokes every token issued off it.