OAuth2 flow support (Authorization Code + PKCE + token refresh) #6
Description
Why: Many APIs (Google Sheets, Meta Ads, Spotify, etc.) require OAuth2 tokens that expire. Currently Vault can only store static tokens — when they expire, the user must manually re-authenticate.
Scope:
- Authorization Code flow with PKCE
- Token refresh (store refresh_token, auto-get new access_token)
- Support for Google, Meta, Slack, Shopify OAuth2 providers
Use cases:
- Google Sheets API with user OAuth tokens
- Meta Ads API with long-lived tokens that need periodic refresh
- Spotify API for user-scoped requests
Priority: High — unlocks a large class of APIs