Change token endpoints and utils to return expires_in and refresh_token_expires_in as seconds-until-expiry (RFC 6749 §5.1) by computing (expiry - now).total_seconds() instead of returning epoch timestamps. Update docs examples and frontend type comments to reflect the new semantics. Also make token-exchange determine client_type from the X-Client-Type request header (with fallback/sanitization) because stored oauth_state.client_type can be missing for system browser flows.