fix: retain tokens on transient refresh failures

[ryanduguid]

Summary

• preserve cached OAuth credentials for transient refresh failures
• clear a cache entry only for an explicit 400 invalid_grant token-endpoint response
• use the same refresh/error policy for pre-flight expiry refreshes and 401 retries
• add regression tests for network, 5xx, and confirmed invalid-grant cases

A network outage or 5xx response does not prove a refresh token is invalid. Clearing cached credentials in those cases forced unnecessary reauthentication and could erase a still-valid session.

Validation

• npm test (10 files, 139 tests)
• npm run build
• npx tsc --noEmit
• git diff --check