Make authorization code redemption single-use and atomic

[markwylde]

Summary

Authorization codes are checked and consumed non-atomically in the token exchange flow.

Evidence

• packages/api/src/controllers/user/token.ts loads the code, issues tokens, and only then marks the code as consumed.
• No transaction protects the consumed check + state transition.

Security Impact

Concurrent redemption requests can race and mint multiple token sets from a single authorization code, breaking single-use guarantees.

Required Fix

• Consume or delete the authorization code in a transaction before issuing any tokens.
• Ensure only one request can transition a code from active to consumed.
• Fail all subsequent redemption attempts deterministically.

Acceptance Criteria

• Concurrent redemption attempts yield exactly one success.
• No tokens are minted after code is already consumed.
• Tests cover race/concurrency scenarios.

Source

Security Review dated 2026-02-15, Finding 2 (High).