Trade a single-use exchange code → token + refreshToken + user

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.