Exchange credentials for an API token

Does not require authentication. grant_type is one of password, refresh_token, apple_identity_token (native Sign in with Apple) or authorization_code (the code returned to the mobile app by /api/v1/auth/authorize, with its PKCE code_verifier and the app redirect_uri). Optional offline: true (password and apple_identity_token) adds the offline_access scope, so the refresh token is an offline token that survives 30 days without use; refresh_token keeps the scope of the token it renews.