The token endpoint wrapped parse_request in try/except but
called process_request and do_response unguarded, so a parseable-but-invalid request (e.g. a refresh_token grant missing client_id, or an
unknown token) made idpyoidc raise and surfaced as a 500. Wrap both so failures return a clean 400 invalid_request and log the traceback
server-side. Adds a regression test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
