Update coinbase

[cpruijsen]

Update the built-in coinbase authorize and token URLs to https://login.coinbase.com/oauth2/auth and https://login.coinbase.com/oauth2/token, and document in Provider Quirks that Coinbase rejects a redirect URI containing the word coinbase, so redirect_uri must be set explicitly.

Fixes #318.

Provenance

Both parts follow what is already established on the issue:

• The new endpoints are the ones reported in Coinbase config update? #318, where the reporter also confirmed the old URLs still work and redirect to these.
• The Quirks approach is the one you specified: "Updating the authorization URLs will be easy. As for the redirect URL, I think the best option is to list it in the Quirks section at the bottom of the main readme file - that the redirect_uri needs to be specified explicitly."

The provider key stays coinbase, so existing /connect/coinbase users are unaffected. Renaming it to something like coin would break them, and you noted the default name usually tracks the provider domain.

Verification

npx mocha test/config.js passes; the ctor coinbase case asserts the new endpoints.

What I have not verified myself is a live authorization round trip against Coinbase, which needs a Coinbase developer account. If you would rather that be confirmed before merging, say so and I will register one and report back. I did not want to claim an end-to-end check I had not run.

Optional

The Quirks note ends with a sentence about redirecting the user on to Grant's /connect/coinbase/callback route. Happy to drop it and leave only "specify redirect_uri explicitly" if you find it clearer.