OAuth for agents

Authorization Code + PKCE S256. Refresh rotation with family revoke on reuse.

Canonical Better Auth authorize + PKCE S256.

Canonical Better Auth token exchange.

Canonical Better Auth revoke. Workspace grant ends immediately.

Legacy 302 to /api/auth/oauth2/authorize.

410 Gone. Use /api/auth/oauth2/token. POST is not redirected.

410 Gone. Use /api/auth/oauth2/revoke. POST is not redirected.

Consent selects workspaces. Knobase does not default to the first membership.
Revoking the grant or membership takes effect immediately, even if the access token has not expired.
Discovery: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource advertise Better Auth only.