Consider removing or extending refresh token expiration for OAuth apps

## Problem Our OAuth token implementation has several issues deviating from OAuth 2.1 / RFC 9700 best practices: 1. **Refresh tokens expire too aggressively** — Share a 30-day `expires_at` with access tokens on one `ApiToken` row. Dormant integrations must re-authorize. 2. **Refresh token rotation has no grace period** — Concurrent refreshes permanently lose the refresh token. 3. **Only one active access token** — Lives on the same row. Concurrent refreshes overwrite each other. 4. **Access tokens are too long-lived** — 30 days vs industry norm of 1–8 hours. 5. **Root cause**: `ApiToken` conflates the authorization (refresh token, user, scopes) and the credential (access token, expiry) on a single row. ## Spec Requirements (RFC 9700 / OAuth 2.1) ### Refresh Token Rotation **RFC 9700 §2.2.2** (exact text): > "Refresh tokens for public clients **MUST** be sender-constrained or use refresh token rotation as described in Section 4.14. [RFC6749] already mandates that refresh tokens for confidential clients can only be used by the client for which they were issued." **RFC 9700 §4.14.2** (exact text): > "Refresh token rotation is **RECOMMENDED**." Summary: - **Public clients** (`client_secret=None`): **MUST** rotate (or use sender-constrained tokens) - **Confidential clients** (have `client_secret`): Rotation is **RECOMMENDED**, not MUST ### Reuse Detection **RFC 9700 §4.14.2** (exact text): > "The authorization server **SHOULD** detect refresh token reuse. If a refresh token is used twice, the authorization server **SHOULD** revoke all access tokens based on that refresh token." ### Refresh Token Expiration **OAuth 2.1 §1.3.2**: "There is no property defined to communicate the expiration of a refresh token to the client." **RFC 9700**: Uses **SHOULD** for inactivity-based expiration: "Refresh tokens SHOULD expire if the client has been inactive for some time." Duration is at server discretion. "Non-use" means the refresh token hasn't been exchanged for a new access token …