Preserve Cloudflare OAuth token exchange errors

The Cloudflare Gatekeeper collapses every non-2xx token response into `null`, so `acceptAuthCode()` reports the same "exchange failed or returned no refresh token" error for invalid client credentials, rejected grants, and provider failures.

This makes production OAuth failures unnecessarily difficult to diagnose. In one deployment, the provider returned `401 invalid_client`, but the actionable cause was discarded before it reached Worker logs.

Expected behavior:

- Preserve the HTTP status and OAuth `error` / `error_description` fields for rejected token exchanges.
- Do not include client credentials, authorization codes, access tokens, or refresh tokens in the error.
- Keep successful token parsing unchanged.

The provider error payload is the standard OAuth response and gives operators enough information to distinguish client configuration from grant and scope failures.

Start at the Cloudflare Gatekeeper token exchange and the acceptAuthCode() entry point described in the issue. Trace how non-2xx responses become null, then verify that rejected exchanges retain their HTTP status and OAuth error fields without exposing credentials or tokens, while successful token parsing remains unchanged.

Written by the indexing model from the issue text.