Separate OAuth2 grant validation

[adamtheturtle]

The OAuth2 token handler combined request parsing, grant dispatch, two distinct authentication workflows, scope validation, and response construction. That required both Ruff and Pylint complexity suppressions.

This splits the client-credentials and password-grant validation into focused functions and shares only the access-token response construction. The public endpoint behavior and exact response payloads remain unchanged.

Validation:

• all configured pre-commit and pre-push hooks
• full non-real-backend suite: 1,957 passed, 833 skipped
• changed production module: 100% local statement and branch coverage
• hosted coverage remains authoritative for real-service and platform-only partitions

[adamtheturtle]

The exact-head Test workflow is terminal. In addition to the two ProjectSuspended failures already present on current main, the real-Vuforia missing-basic-auth case could not connect to vws.vuforia.com/oauth2/token and exhausted its retries with ConnectTimeout. That external abort caused the combined coverage job to see 99%. The full non-real suite passes locally (1,957 passed, 833 skipped), and the changed production module is at 100% local statement and branch coverage.