V00.77 opt-in module: OAuth2 Relying-Party HTTP flows — authorization-code (+ PKCE), token endpoint with client authentication (basic / post / secret-jwt / private-key-jwt / none), refresh-token rotation with reuse-detection, revocation, introspection and device-authorization grant. JDK HttpClient only; the in-tree JSON scanner parses responses (no JSON library). private_key_jwt / client_secret_jwt sign via the jCustos-jwt JwtSigner. Framework-neutral — no Vaadin / REST ...