Summary
Per the PLEN-2215 audit (Pattern B "hard breakage"), paychex_oauth was declared mode: 'OAUTH2' with authorization_url === token_url and grant_type: 'client_credentials' — an OAUTH2 scheme cannot have those properties; the redirect step is fiction and the scheme has never produced a working connection.
Paychex API supports client_credentials only (server-to-server, single endpoint at /auth/oauth/v2/token), so this PR replaces the broken OAuth2 scheme with S2S_OAUTH2 (paychex_s2s_oauth2):
client_id/client_secret exposed as auth_config_field (admin-managed, since Paychex API credentials are issued from the Developer Portal and are not per-end-user).
auth_method: 'body' — Paychex's token endpoint accepts form-encoded credentials in the body.
- Drops the unused
authorization_url and PKCE settings.
Pattern matches PayPal's S2S migration (ComposioHQ/mercury#21885) and the Neo4j sibling (ComposioHQ/mercury#23064).
⚠️ Backwards compatibility: existing connections (if any) under paychex_oauth will need to be re-created under paychex_s2s_oauth2, since the scheme name changes. Per the audit, the prior scheme could not produce a working token, so impact should be minimal.
Refs: PLEN-2215.
Test plan