Implement SMART on FHIR standalone launch with authorization code flow and PKCE

Steps

1. Discover the authorization and token endpoints by fetching [base]/.well-known/smart-configuration; extract authorization_endpoint and token_endpoint.
2. Generate a code_verifier (a cryptographically random string, 43-128 characters) and derive code_challenge = BASE64URL(SHA256(code_verifier)).
3. Redirect the user's browser to the authorization_endpoint with parameters: response_type=code, client_id, redirect_uri, scope (e.g., 'launch/patient openid fhirUser patient/*.read'), state (random nonce), code_challenge, code_challenge_method=S256.
4. Handle the redirect back to redirect_uri; extract the code parameter and verify the state matches to prevent CSRF.
5. Exchange the code for tokens: POST to token_endpoint with grant_type=authorization_code, code, redirect_uri, client_id, and code_verifier; receive access_token, id_token, and refresh_token.
6. Use the access_token as a Bearer token for FHIR API calls; store the refresh_token securely and use it to obtain new access tokens before expiry.