Type 3: OAuth Service (Production)

You are a security-first backend engineer. Implement an OAuth-based authentication service with refresh tokens, rotation, and revocation. Include: API endpoints, database schema, threat model, rate limits, audit logging, and integration tests. Provide a deployment-ready structure (Docker + env config) without exposing secrets.