fix: Preserve AuthMode and fix scope corruption on OAuth token refresh

[FelixLisczyk]

Summary

This PR addresses two remaining gaps in the OAuth token refresh flow after PR #8.

Bug 1 — AuthMode lost after first token refresh

refreshTokenLocked() already preserves RefreshToken from the existing token
when the OAuth server's response omits it. However, the same preservation was missing
for AuthMode. Since the OAuth protocol never includes auth_mode in a refresh
response, the field is silently dropped on the first refresh. The saved token file
then has an empty auth_mode, which breaks --assignee me resolution for users
who authenticated in agent mode.

Fix: apply the same "preserve if absent" guard to AuthMode in refresher.go,
mirroring the existing RefreshToken logic.

Bug 2 — SanitizeToken corrupts JSON string values containing spaces

LoadTokenData() called SanitizeToken() on the entire raw file content before
parsing it as JSON. SanitizeToken strips all whitespace characters, which corrupts
any JSON string value that contains a space — for example a scope field of
"read write" becomes "readwrite". The JSON structure remained parseable, so the
corruption was silent.

SaveTokenData already sanitizes the individual AccessToken and RefreshToken
fields before writing, so sanitizing the whole document on load is redundant for the
JSON path and actively harmful. The fix moves SanitizeToken to the legacy
plain-string fallback path only, where it is still needed.

Test plan

• TestRefresher_PreservesAuthModeOnRefresh — verifies AuthMode is carried over
  when the refresh response does not include it
• TestRefresher_DoesNotOverwriteAuthModeWhenPresent — verifies a new AuthMode
  in the response wins over the old one
• TestRefresher_PreservesRefreshTokenWhenAbsent — regression guard for the
  existing RefreshToken preservation logic
• "load token data JSON with spaces in scope" — directly reproduces the
  space-stripping bug and verifies the fix
• make test passes (all existing tests remain green)

🤖 Generated with Claude Code