OAuth2 授权码流程

sequenceDiagram
    autonumber
    actor User
    participant App as Client app
    participant Auth as Authorization server
    participant API as Resource API

    User->>App: Click "Sign in"
    App->>Auth: Redirect with client_id + scope
    Auth->>User: Login and consent screen
    User->>Auth: Approve
    Auth-->>App: Redirect with authorization code
    App->>Auth: Exchange code + client secret
    Auth-->>App: Access token + refresh token
    App->>API: GET /me with Bearer token
    API-->>App: 200 profile JSON