OAuth 2.1 token endpoint (authorization_code and refresh_token)

RFC 6749 token endpoint. Body is application/x-www-form-urlencoded. Answers 404 while OAUTH_ENABLED is off. No Tre bearer — clients authenticate with CIMD (none public clients or private_key_jwt). Access tokens last one hour; each refresh rotates the refresh token and grants it another 30 days (sliding), under an absolute cap of 90 days from the grant’s creation — past it the refresh answers invalid_grant, the grant is revoked, and the person consents again. Every refusal of an authorization code answers invalid_grant with the one description "The authorization code is invalid". A resource (RFC 8707) is optional; every one sent must be this server’s MCP endpoint, or the request answers invalid_target. Failures use the OAuth error object (error / error_description), not Tre’s { error: { code, message } } shape.