How does OAuth2 work with AS/400, mainframe RSE, or the mock provider?

Sign-in validates against the configured provider (IBM i security, RSE API, or mock that accepts any credentials). A JWT access token is issued and used on later API calls; refresh is automatic. Configure providers in _auth-config.yaml. Mock is for demos — not production.