Desktop application sign-in

A desktop client can open the browser for sign-in and receive a short-lived callback through a validated application URL or local redirect.

Validate state values, keep tokens outside application logs and revoke sessions when the user signs out.