47fb562326
Replace `assert entry.code_challenge` with a proper if-guard returning a 500 JSON error in the token endpoint, since Python's -O flag strips asserts and would silently disable PKCE enforcement. Invalidate the scope cache immediately after Login Flow v2 provisioning completes, so users no longer hit ProvisioningRequiredError for up to 5 minutes after successfully authenticating. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>