test(08-04): add failing code-exchange RED test in wristband

- Server.Token 501 stub and TestPhase8RedCodeExchange (PHASE8_RED:code-exchange)
- Options gains AccessTokenTTL/RefreshTokenTTL with PHP-parity defaults

wristband/server.go

@@ -68,6 +68,16 @@ type Options struct {
 	// created by authorize stays valid (PHP
 	// OAuthCodeManager::PENDING_TTL_SECONDS, D-03). PHP default: 600s.
 	PendingRequestTTL time.Duration
+
+	// AccessTokenTTL is how long an inv_ access token minted by a successful
+	// code exchange or refresh rotation stays valid (PHP
+	// OAuthCodeManager::ACCESS_TTL_SECONDS, D-03). PHP default: 3600s (1h).
+	AccessTokenTTL time.Duration
+
+	// RefreshTokenTTL is how long a refresh-token lineage row stays valid
+	// from issuance (PHP OAuthCodeManager::REFRESH_TTL_DAYS, D-03). PHP
+	// default: 30 days.
+	RefreshTokenTTL time.Duration
 }
 
 // DefaultOptions returns PHP-parity defaults for every metadata option
@@ -83,6 +93,8 @@ func DefaultOptions() Options {
 		RegisterMaxBodyBytes:                       65536,
 		Resource:                                   "https://mcp.plytarium.com/mcp",
 		PendingRequestTTL:                          600 * time.Second,
+		AccessTokenTTL:                             3600 * time.Second,
+		RefreshTokenTTL:                            30 * 24 * time.Hour,
 	}
 }