Authorization code value echoed in token endpoint error messages

Describe the bug When an invalid or expired authorization code is submitted to the token endpoint, the server echoes the exact code value back in the JSON error response:

# app/oauth/views/token.py line 49
return jsonify(error=f"no such authorization code {code}"), 400

# app/oauth/views/token.py line 54
return jsonify(error=f"{code} already expired"), 400

Echoing the authorization code in the response body is an information leak. It allows an attacker to:

1. Confirm whether a guessed code format/value was ever issued by the system.
2. Observe the exact entropy and format of the generated codes.
3. Distinguish between "never issued" and "expired" codes, aiding in timing-based enumeration attacks.

Expected behavior The endpoint should return a generic, standard OAuth 2.0 error message without reflecting the sensitive request parameters back to the client: return jsonify(error="invalid_grant", error_description="The authorization code is invalid or expired."), 400

Additional context Files: app/oauth/views/token.py lines 49 and 54.