Fix OAuth refresh for long-lived ACP sessions

[halfaipg]

Summary

• refresh Codebase OAuth credentials before every ACP session and model rebuild
• allow refreshable expired OAuth credentials to construct proxy agents
• align credential preflight with the five-minute TokenManager safety window
• add regression coverage for long-lived Buzz-style ACP sessions

Verification

• npm run typecheck
• npm run lint
• npm test (1,300 passed)
• forced-expiry ACP session returned NEW-SESSION-REFRESH-OK
• installed pre.83 build in Buzz returned BUZZ-PRE83-OK