Retain OAuth tokens after transient refresh failures

[ryanduguid]

Summary

Retains usable cached credentials on transient refresh failures while hardening the credential-bearing token POST.

• clears cached credentials only when an HTTP 400 response contains the strict OAuth identifier invalid_grant;
• removes error_description from the error type and never retains or reflects token-endpoint descriptions, bodies, URLs or transport messages;
• preserves a rotated refresh token returned by a successful refresh and retains the old token when a response omits rotation;
• sends the refresh POST with redirect: error, a 10-second abort deadline and a one-call mocked proof that a redirect target is never contacted;
• bounds both success and error response streams at 64 KiB, cancels an oversized stream and returns generic errors;
• parses success JSON into a validated TokenSet allow-list instead of retaining arbitrary response fields;
• rejects malformed success data without reflecting its contents.

Verification at eae89091d8202a04e9520f7e14c4936ac26a80bb

• npx vitest run test/lib/oauth-refresh.test.ts test/lib/xero-client-refresh.test.ts — 12 passed;
• coverage includes invalid_grant classification, secret-bearing descriptions/messages, transient 5xx and transport failure, redirect rejection/no-target call, timeout, oversized stream cancellation, malformed success JSON, token retention and refresh-token rotation;
• npm run build passed;
• git diff --check passed.

Every credential is synthetic. No OAuth or Xero API call was made.