User authentication

You are adding "Connect with Agentcard" to this app: the user enters a one-time
code and we hand back their Agentcard connection — no redirects. Implement it
server-side. NEVER send the user to a hosted Agentcard/MCP sign-in page (e.g.
mcp.agentcard.sh) — this API replaces it entirely.

PREREQUISITES
- client_id + client_secret from the Agentcard dashboard (Organization ->
  Developer -> Credentials -> create a client). Store as backend env vars.
  A sandbox client works now; a production client needs an active subscription.
- Base URL https://api.agentcard.sh. All calls are backend-to-backend; never
  expose the secret or any token to the client.

1. PLATFORM TOKEN (cache ~55 min)
POST /api/v2/oauth/token  (x-www-form-urlencoded)
  grant_type=client_credentials & client_id=... & client_secret=...
-> { access_token }. Send `Authorization: Bearer <access_token>` on every call.

2. SEND THE CODE
POST /api/v2/connect/start  { "email": "<email>" }   // or { "phone": "<E.164>" }, exactly one
-> 201 { id }   // store as connect_id

3. USER ENTERS THE CODE in your UI.

4. VERIFY
POST /api/v2/connect/verify  { "connect_id": "<id>", "code": "<code>" }
-> 200 { access_token, refresh_token, expires_in, user: { id, email, phone } }
Store user.id and the connection access_token + refresh_token (encrypted, per
user). 401 invalid_code -> re-prompt. invalid_connect_attempt -> restart.

5. RECORD CONSENT (when the user authorizes you) — do not skip
POST /api/v2/connect/consent  { "user_id": "<user.id>", "terms_version": "<version>" } -> 201.
Also covers the card issuer's terms: without it, identity verification later
pauses the user on an extra terms page instead of going straight to the scan.

REFRESH: tokens expire in 1h. POST /api/v2/connect/refresh { "refresh_token": "<stored>" }
-> new pair; replace BOTH stored tokens.
ERRORS: { error: { code, message, docs } } — branch on code.