Exempt oauth/token from CSRF — server-to-server API endpoint

External clients like artdag POST to this endpoint from their
backend, so there's no browser session with a CSRF token.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

bp/auth/routes.py

@@ -123,6 +123,9 @@ def register(url_prefix="/auth"):
 
     # --- OAuth2 token exchange (for external clients like artdag) -------------
 
+    from shared.browser.app.csrf import csrf_exempt
+
+    @csrf_exempt
     @auth_bp.post("/oauth/token")
     @auth_bp.post("/oauth/token/")
     async def oauth_token():