Include the full implementation spec document with:
- OAuth protocol details (endpoints, token formats, lifetimes)
- Implementation plan with code snippets
- Live testing results from 2026-01-28:
- Required headers (User-Agent + X-Msh-Platform) for API access
- Required compat flag (supportsDeveloperRole: false)
- Single-use refresh token behavior
- Successful end-to-end test with Vulkan agent on Kimi Code
