HTTP OAuth2 flow (auth code exchange + refresh) via reqwest, plus protobuf-level two-phase auth (ApplicationAuth → AccountAuth) over the TCP connection. Error extraction from OA error responses. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>