Exchange an authorization code for access and refresh tokens, or refresh an expired access token.

Authorization code exchange: Send grant_type=authorization_code with the code from the authorize redirect,
along with redirect_uri, client_id, and code_verifier (if PKCE was used).

Token refresh: Send grant_type=refresh_token with the refresh_token and client_id.
The old token is revoked and new tokens are issued.

Access tokens expire after 1 hour. Refresh tokens expire after 30 days.