tento-oauth

tento-oauth holds shared OAuth helpers used by provider SDKs.

Public surface

• oauth contains token and refresh helpers shared across providers.
• The crate depends on magic-crypt for encrypted token handling and chrono for expiry math.

Boundaries

Provider-specific OAuth flows, scopes, and endpoint URLs belong in provider crates such as tento-google, tento-garmin, or tento-whoop. This crate should contain only reusable mechanics that do not know about a particular vendor.

Credential storage remains a host concern. Provider crates can define their auth types, but hosts decide where encrypted tokens are persisted.