f5afe8bd40
Add explicit RFC 8628 device login and oauth.flow selection while keeping browser PKCE and the SDK runtime refresh path. Reuse issuer/resource validation, configured client authentication and profile-scoped storage. Only persist an approved, validated grant; never echo endpoint error bodies. Slim redo of #104752 by @wjorgensen, replacing duplicate HTTP/storage wrappers with the existing SDK and two real-wire invariant tests. Refs #104742 Co-authored-by: Wes Hermes <weshermes@Wess-Mac-mini.localdomain>