Wire token exchange config for /auth/token and /auth/refresh endpoints.
clientSecret loaded from AUTH_CLIENT_SECRET env var (never from YAML).
Backward compatible — missing fields default to zero values.
3 new tests covering: full config, env-only secret, backward compat.
Closes homelab#12
Co-authored-by: poimen <[email protected]>
