A one-time authorization code (OAuth 2.0 authorization code grant with
PKCE). Stored hashed; bound to the subject who consented, the client and
redirect URI it was issued for, and the PKCE challenge the token exchange
must answer. Five minutes to live, single use (used_at).
subject_id is the host's opaque subject, stored in the column
Managoat.OAuth.Migration names user_id by default. The library never
joins it; a host that wants a foreign key adds one in its own migration.