Move OpenLibrary.org <> Archive.org to OAuth PKCE relationship

### Feature Request

## Problem / Opportunity

There are 3 key APIs

1. BookReader hmac backdoor (plugins/upstream/borrow.py)
2. Lening API (core.lending); e.g. groundtruth and borrow
3. Xauthn (accounts/model.py)

Maintainability; the BookReader case is a liability because it's a one-off API with no real maintainer or visibility.

## Proposal

### Breakdown

Implementation Details (for maintainers)

#### Related files

Refer to [this map of common Endpoints](https://docs.openlibrary.org/developers/backend/endpoints.html):
*

#### Requirements Checklist
Checklist of requirements that need to be satisfied in order for this issue to be closed:
* [ ]

#### Stakeholders

*

#### Instructions for Contributors

* **Before** [creating a new branch](https://docs.openlibrary.org/developers/tools/git.html#making-changes-and-creating-a-pull-request) or pushing up changes to a PR, please first [run these commands](https://docs.openlibrary.org/developers/tools/git.html#working-on-your-branch) to ensure your repository is up to date, as the pre-commit bot may add commits to your PRs upstream.

Start by reading plugins/upstream/borrow.py, core.lending, and accounts/model.py, which identify the three APIs involved. Map how BookReader HMAC, lending, and Xauthn currently interact before proposing an OAuth PKCE relationship. The issue does not define success criteria or a requirements checklist, so maintainers must specify the migration and validation steps.

Written by the indexing model from the issue text.