Authorization code value echoed in token endpoint error messages

[Allen-wick]

Describe the bug
When an invalid or expired authorization code is submitted to the token endpoint, the server echoes the exact code value back in the JSON error response:

# app/oauth/views/token.py line 49
return jsonify(error=f"no such authorization code {code}"), 400

# app/oauth/views/token.py line 54
return jsonify(error=f"{code} already expired"), 400

Echoing the authorization code in the response body is an information leak. It allows an attacker to:

1. Confirm whether a guessed code format/value was ever issued by the system.
2. Observe the exact entropy and format of the generated codes.
3. Distinguish between "never issued" and "expired" codes, aiding in timing-based enumeration attacks.

Expected behavior
The endpoint should return a generic, standard OAuth 2.0 error message without reflecting the sensitive request parameters back to the client:
return jsonify(error="invalid_grant", error_description="The authorization code is invalid or expired."), 400

Additional context
Files: app/oauth/views/token.py lines 49 and 54.