POST /auth/token: exchanges username+password for JWT via upstream
identity provider (grant_type=password).
POST /auth/refresh: exchanges refresh_token for new JWT.
Both proxy to Authentik token endpoint using config from P3.7.
Upstream responses forwarded verbatim. No credentials logged or
leaked in responses. authClient interface extracted for testability.
15 tests covering: success, custom scope, missing fields, invalid
JSON, wrong method, not configured, upstream error, credential
rejection, token expiry, no credential leak.
Closes homelab#6
Closes homelab#8
Co-authored-by: poimen <[email protected]>
