#6 Add OAuth exchange_code (POST /api/token)

[nstillman-te]

Part of #6.

Adds client.oauth.exchange_code() to exchange an authorization code for an access token (POST /api/token). Completes the OAuth2 Authorization Code + PKCE flow: call after the user returns from the authorization URL with a code. Response typed as OAuthTokenResponse (token_type, access_token, expires_in). Requests-mock tests verify response shape and form body params.

Checklist when adding a new endpoint

• Added new endpoint to the README.rst
• Ensured that my endpoint name does not repeat the name of the client. Wrong: client.users.get_user(), Correct: client.users.get()
• Typed the returned JSON using TypedDicts in berserk/types/ — OAuthTokenResponse in berserk/types/oauth.py
• Written tests (requests-mock for POST form body and response validation; no VCR — endpoint requires valid code)
• Added the endpoint to CHANGELOG.rst in the To be released section