- Use atomic getdel for pairing code exchange - Add cascade="all, delete-orphan" to User.client_tokens - Move generate/hash_client_token into AuthHandler as static methods - Extract endpoint helpers to utils/client_tokens.py