admin: implicit grant auth — this GitLab can't finish a PKCE public-client exchange

public/admin/config.yml

@@ -9,10 +9,13 @@ backend:
   # (Sveltia does not infer them from the repo URL).
   base_url: https://git.nech.pl
   api_root: https://git.nech.pl/api/v4
-  # PKCE: no client secret anywhere. If this GitLab version rejects PKCE,
-  # fall back to implicit grant — add `auth_type: implicit` and keep the same
-  # app_id (the OAuth app must then allow the implicit grant flow).
-  auth_type: pkce
+  # Auth: this GitLab (12.x-era) accepts the PKCE authorize step but fails the
+  # public-client token exchange ("failed to request an access token") — so we
+  # ride the implicit grant instead. The OAuth app must have "Implicit grant"
+  # checked; "Confidential" stays unchecked. Token is short-lived (GitLab
+  # default ~2h) — re-login expected; the Phase 1 auth sidecar replaces this
+  # with a confidential exchange + refresh.
+  auth_type: implicit
   # Paste the OAuth application ID from git.nech.pl (Admin area -> Applications;
   # redirect URI https://me.nech.pl/admin/, "Confidential" unchecked, api scope).
   app_id: d8696dc65c5f2308ce16f3a0ddbcfb913915562917ad4647cfaa3ea843dee287