Exchange a code, rotate a refresh token, or redeem a device code

Anonymous public-client token endpoint (no client secret). grant_type authorization_code (PKCE S256 code_verifier required; code is one-use, 60 s, bound to client_id + redirect_uri), refresh_token (rotates on every use; reusing a spent one revokes the whole connection; scopes re-intersected with the member's live tier), or urn:ietf:params:oauth:grant-type:device_code (RFC 8628 §3.5 shape over /api/agent/signup/poll). The access_token is an ordinary agt_ token valid 1 h. 404 unless the deployment sets OAUTH_CODE_FLOW_ENABLED=true.