Grant Authorization

Mint an authorization code for the signed-in user.

Authenticated with the user's own JWT (the consent page sends it from localStorage), so the identity being granted is unambiguous and no cross-site form can trigger it.

The code stores the redirect_uri exactly as presented (for a CIMD loopback redirect that includes the ephemeral port), and /oauth/token demands that same string.