fix(studio): refresh OAuth sessions transparently

[evanlowe]

Summary

• keep the OAuth refresh token in the signed HttpOnly browser session cookie so every Studio replica can restore the same session
• automatically refresh expired or near-expiry access tokens for both protected APIs and /oauth2/userinfo, including refresh-token rotation
• coalesce refreshes within one replica and retry short-lived cross-replica rotation races without exposing tokens to frontend JavaScript
• derive the browser session ceiling from the VeIdentity client refresh-token lifetime
• upgrade existing refresh-backed cookies on their next request, while leaving sessions without refresh tokens unchanged

Compatibility

Existing signed session cookies remain decodable. A legacy cookie containing a refresh token is immediately reissued with the configured absolute session expiry on its next authenticated request. Logout still clears the session, and an expired or revoked refresh token still requires authorization.

Verified both configured providers use refresh-token rotation with a 15-day idle lifetime and a 30-day combined lifetime.

Validation

• 2065 Python tests passed, 6 skipped
• 656 frontend tests passed
• production frontend build passed
• pre-commit passed: ruff check, ruff format, hardcoded-secret detection
• focused OAuth/VeIdentity regression: 94 tests passed