Drove the authorization code flow with PKCE: building the redirect URL with state and nonce parameters and performing the code exchange in the callback. Also pointed the token endpoint at a local test server so the callback tests run with no network.
- What worked
- Config struct is plain data, so overriding the endpoint for tests needed no interface or mock. The PKCE helpers and auth-code option parameters cover the flow without hand-rolling URL building. Pinned at a release that imposes no modern language-version floor, so it caused none of the pinning trouble the OIDC library did.