Support bounded OAuth code exchange and refresh in v26.10.02

[ancongui]

OAuth providers can require HTTP Basic authentication for authorization-code exchange and an explicit refresh grant. Add both to the public OAuth2Client, with optional resource identifiers, so applications can use the native bounded transport for these connections. Existing valid code-exchange requests retain their default form authentication and wire format.

Code exchange and refresh validate bounded request values before HTTP and dispatch once. Resource identifiers are sent only to the configured token endpoint; they are never fetched. The application remains responsible for callback binding, approved scopes, encrypted storage, serialized rotation and reconciliation after an uncertain refresh. The documentation describes those boundaries and the release updates current version references to v26.10.02 / package 26.10.2.

Validation:

• Installed OAuth suite: 279 passed; 18 additional independent contract checks passed; six actual local HTTP exchanges verified.
• Installed core suite: 9,144 passed, seven skipped and one release-metadata failure. The stale installer and current documentation version references were corrected; the follow-up metadata, installer and OAuth suite passed all 299 tests. The full suite was not repeated locally solely for those version literals; CI runs the final commit.
• Ruff, strict mypy, compilation, shell syntax, lock validation and strict MkDocs build passed. Book tests passed all 83 cases, with code listings verified in both editions.
• All 922 package entries matched source, wheel and installed distribution; an independent final review found no blocking defect.