Restrict OAuth grant types to approved client capabilities #1720

Goal

Reduce the enabled OAuth/OIDC grant types to those required by supported clients.

Context

The service enables implicit, password, hybrid, authorization-code, client-credentials, device, and refresh-token flows.

Acceptance criteria

• Authorization code with PKCE, client credentials, device authorization, and refresh tokens are supported as approved flows.
• Implicit and resource-owner-password flows are disabled by default.
• Legacy exceptions are explicit, documented, and client-scoped.
• Integration tests verify unsupported grant types are rejected.