OAuth2 token endpoint (client_credentials, password, authorization_code, refresh_token)

Unified grant endpoint. Accepts JSON or application/x-www-form-urlencoded. Returns access_token (JWT) and, for user grants, a rotating refresh_token.