OAuth2/PKCE client for apps authenticating against Honin IDP (honin.id or self-hosted). Handles PKCE generation, authorization URL building, code exchange, RS256 JWT verification via JWKS, and optional Rails integration.