refactor: use Authlib for OAuth flows

[manojbajaj95]

Summary

• Add Authlib as the OAuth client dependency
• Route PKCE authorization URLs, code exchange, refresh, and revocation through a small Authlib-backed helper
• Remove the hand-rolled PKCE generator and duplicated token exchange payload code
• Add focused tests for the Authlib-backed helper and PKCE begin behavior

Verification

• uv run ruff check --fix src/ tests/
• uv run ruff format src/ tests/
• uv run ty check src/
• uv run pytest
• uv run pre-commit run --all-files