Review OAuth2 scopes and token handling

Review the following OAuth2 implementation for security weaknesses: [Paste code]. Check specifically for: overly broad or unnecessary token scopes that violate least privilege, absence of PKCE for public clients where the authorization code could be intercepted, insecure client-side token storage in localStorage or session storage instead of httpOnly cookies, tokens that never expire or lack a short expiry on access tokens, missing refresh token rotation that would allow stolen refresh tokens to be used indefinitely, and improper or missing state parameter validation that leaves the flow vulnerable to CSRF.