One-shot authorization-code and refresh token endpoint client.

Requests are form encoded, carry the exact resource indicator, never retry, and return explicit dispatch provenance. Provider bodies and authentication response headers are projected to closed results before returning.