fix: Add grant_type to IndieAuth token exchange (v0.9.3)

The token exchange request was missing the required grant_type parameter
per OAuth 2.0 RFC 6749. IndieAuth providers that properly validate this
were rejecting the request with a 422 error.

- Add grant_type=authorization_code to token exchange data
- Add ADR-022 documenting the spec compliance requirement

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

docs/reports/2025-11-22-grant-type-fix.md

@@ -0,0 +1,68 @@
+# IndieAuth Token Exchange grant_type Fix
+
+**Date**: 2025-11-22
+**Version**: 0.9.3
+**Type**: Bug Fix
+
+## Summary
+
+Added the required `grant_type=authorization_code` parameter to the IndieAuth token exchange request.
+
+## Problem
+
+The token exchange request in `starpunk/auth.py` was missing the `grant_type` parameter. Per OAuth 2.0 spec (RFC 6749 Section 4.1.3), the token exchange request MUST include:
+
+```
+grant_type=authorization_code
+```
+
+Some IndieAuth providers that strictly validate OAuth 2.0 compliance would reject the token exchange request without this parameter.
+
+## Solution
+
+Added `"grant_type": "authorization_code"` to the `token_exchange_data` dictionary in the `handle_callback` function.
+
+### Before
+
+```python
+token_exchange_data = {
+    "code": code,
+    "client_id": current_app.config["SITE_URL"],
+    "redirect_uri": f"{current_app.config['SITE_URL']}auth/callback",
+    "code_verifier": code_verifier,
+}
+```
+
+### After
+
+```python
+token_exchange_data = {
+    "grant_type": "authorization_code",
+    "code": code,
+    "client_id": current_app.config["SITE_URL"],
+    "redirect_uri": f"{current_app.config['SITE_URL']}auth/callback",
+    "code_verifier": code_verifier,
+}
+```
+
+## Files Modified
+
+1. **`starpunk/auth.py`** (line 412)
+   - Added `"grant_type": "authorization_code"` to token_exchange_data
+
+2. **`starpunk/__init__.py`** (line 156)
+   - Version bumped from 0.9.2 to 0.9.3
+
+3. **`CHANGELOG.md`**
+   - Added 0.9.3 release notes
+
+## Testing
+
+- Module imports successfully
+- Pre-existing test failures are unrelated (OAuth metadata and h-app tests for removed functionality)
+- No new test failures introduced
+
+## References
+
+- RFC 6749 Section 4.1.3: Access Token Request
+- IndieAuth specification