v0.6.7

What's Changed

• External frontend redirect now includes OAuth metadata: The URL fragment on return_to redirects now passes refresh_token, token_endpoint, client_id, client_secret, and use_id_token so external frontends can refresh tokens independently.
• Token exchange returns refresh_token: _exchange_code_for_token now returns a 3-tuple (token, max_age, refresh_token).
• All fragment values are URL-encoded via urllib.parse.quote.