OAuth 2.0 (PKCE) authentication, plus a migration path off the legacy
single-file config layout. See CHANGELOG.md for details.