[rmcp-client] Refresh short-lived OAuth tokens before requests

[anp-oai]

Intent

Characterize near-expiry OAuth refresh as request-time only and prevent duplicate provider attempts. Separate provider refresh failure from credential persistence failure without adding background refresh or provider-policy workarounds.

User-visible behavior

Before

An idle client did not refresh until activity resumed, and the request boundary was not coordinated across Codex and RMCP. A resumed or concurrent request could reach the MCP path with a near-expiry token, trigger duplicate provider refresh attempts, surface inconsistent or provider-controlled failure details, or repeat the provider refresh after an otherwise successful in-memory refresh when credential persistence failed.

After

Refresh remains request-time only. Before an MCP operation, near-expiry credentials are rechecked under the existing authorization-manager guard, so concurrent requests share one provider refresh attempt. Provider refresh failure returns one stable, bounded error before the MCP request. When refresh succeeds in memory, those credentials remain usable for the MCP operation even if durable persistence fails; persistence stays dirty and retries on a later operation without another provider refresh.

Concrete implementation

• Recheck and refresh through RMCP while holding the existing authorization-manager guard, so concurrent near-expiry requests share one provider attempt.
• Map provider refresh failure to a bounded stable error that omits provider-controlled descriptions and aborts before the MCP request.
• Treat persistence after a successful in-memory refresh as best effort; failed writes remain dirty and retry on the next operation without another provider refresh, narrowly matching [rmcp-client] Classify OAuth refresh and storage failures correctly #26519 semantics.
• Replace elapsed-time lifecycle coverage with deterministic idle checkpoints plus success, rejection, persistence recovery, and concurrency scenarios. Tests verify exact metadata/provider counts, durable refreshed credentials, and unchanged state after rejection.

Validation not covered by CI

None. Local validation ran the five focused lifecycle tests, just fix -p codex-rmcp-client, and just fmt.

PR splitting, background refresh, timed provider-policy expiry, provider workarounds, and general request-timeout redesign remain deferred.

[anp-oai]

handing this off for now