feat(phase-3): implement token endpoint and OAuth 2.0 flow

Phase 3 Implementation:
- Token service with secure token generation and validation
- Token endpoint (POST /token) with OAuth 2.0 compliance
- Database migration 003 for tokens table
- Authorization code validation and single-use enforcement

Phase 1 Updates:
- Enhanced CodeStore to support dict values with JSON serialization
- Maintains backward compatibility

Phase 2 Updates:
- Authorization codes now include PKCE fields, used flag, timestamps
- Complete metadata structure for token exchange

Security:
- 256-bit cryptographically secure tokens (secrets.token_urlsafe)
- SHA-256 hashed storage (no plaintext)
- Constant-time comparison for validation
- Single-use code enforcement with replay detection

Testing:
- 226 tests passing (100%)
- 87.27% coverage (exceeds 80% requirement)
- OAuth 2.0 compliance verified

This completes the v1.0.0 MVP with full IndieAuth authorization code flow.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/gondulf/database/migrations/003_create_tokens_table.sql

@@ -0,0 +1,23 @@
+-- Migration 003: Create tokens table
+-- Purpose: Store access token metadata (hashed tokens)
+-- Per ADR-004: Opaque tokens with database storage
+
+CREATE TABLE IF NOT EXISTS tokens (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    token_hash TEXT NOT NULL UNIQUE,          -- SHA-256 hash of token
+    me TEXT NOT NULL,                         -- User's domain URL
+    client_id TEXT NOT NULL,                  -- Client application URL
+    scope TEXT NOT NULL DEFAULT '',           -- Requested scopes (empty for v1.0.0)
+    issued_at TIMESTAMP NOT NULL,             -- When token was created
+    expires_at TIMESTAMP NOT NULL,            -- When token expires
+    revoked BOOLEAN NOT NULL DEFAULT 0        -- Revocation flag (future use)
+);
+
+-- Indexes for performance
+CREATE INDEX IF NOT EXISTS idx_tokens_hash ON tokens(token_hash);
+CREATE INDEX IF NOT EXISTS idx_tokens_expires ON tokens(expires_at);
+CREATE INDEX IF NOT EXISTS idx_tokens_me ON tokens(me);
+CREATE INDEX IF NOT EXISTS idx_tokens_client ON tokens(client_id);
+
+-- Record this migration
+INSERT INTO migrations (version, description) VALUES (3, 'Create tokens table for access token storage');