docs: align comments with strict-200 OAuth check, fix interface wording

Review nits from Copilot on #1402: PostOAuthToken treats anything but 200 as an error (RFC 6749 token-endpoint success is 200 only), so say non-200 rather than non-2xx; and "slice of" read as a Go slice where "subset" was meant.