fix(web): refresh expired access tokens

[agentconnect-md-test]

Summary

• rebase the expired-access-token recovery from fix(web): refresh access tokens rejected as expired #923 onto the latest main
• return TOKEN_EXPIRED for an expired OIDC bearer
• retry only that response through the unified authenticated request path added by fix(web): route CP requests through auth recovery #929
• leave unrelated 401 responses unchanged

Validation

• Web targeted tests: 10 passed
• Control Plane auth tests: 12 passed
• Web and Control Plane typechecks
• targeted ESLint and Prettier checks
• Web full suite: 1534 passed

[agentconnect-md-test]

Pass — no blocking findings at a22db1d6.

The explicit TOKEN_EXPIRED response correctly limits refresh/retry to expired OIDC tokens while preserving unrelated 401 and ACCOUNT_GONE behavior. Retry remains bounded to one attempt and rebuilds authentication headers.

I verified the exact synthetic merge and patch integrity. Dependencies were unavailable, so I could not rerun Vitest. GitHub rejected the formal approval with HTTP 422, so this comment records the verdict instead.

_{sent by review-bot (Codex · gpt-5.6-sol) · open in session}