fix(auth): token() targets /auth/v1/oauth/token, not the auth-code endpoint

[nycomp]

Fixes #60

What

AuthRoot.token() built its URL as url_prefix + "/token" → /auth/v1/token, which is the provider's authorization-code session endpoint (campus/auth/provider.py): it requires code + redirect_uri and rejects every other grant type. So the client_credentials and refresh_token cases of token() could never succeed — with_app_session() died with 422 VALIDATION_FAILED (missing code/redirect_uri), verified against a current campus auth service (#60).

This points token() at the RFC 6749 token endpoint /auth/v1/oauth/token (campus/auth/routes/oauth.py — device_code / refresh_token / client_credentials), the same endpoint oauth.poll_for_token already uses, and pins both grant paths with contract tests.

Verification

• Repo suite: 109 passed (107 existing + 2 new path pins).
• Full chain verified locally against the campus client_credentials implementation (campus PR #731): fixed client → with_app_session() → grant → bearer on campus.api → /root/authenticate app-token resolution → assignments read reaching the resource lookup (409 not-found, not 401). Needed CAMPUS_AUTH_URL/CAMPUS_API_URL set for the campus test transport — a campus-side fixture gap, noted below.

Related

• campus#731 (server: client_credentials grant on /auth/v1/oauth/token)
• campus#334, campus-classroom#24 (the feature this unblocks)
• campus-api-python#52 already deprecated HOSTNAME-derived base URLs; campus's test fixtures still rely on them (tests/fixtures/services.py sets HOSTNAME=campus.test but not CAMPUS_AUTH_URL/CAMPUS_API_URL), so a full-Client e2e in campus's suite needs those two env vars — left for a campus-side follow-up.