fix(auth): distinguish rejected refresh tokens from transient failures

[stevenlee-oai]

Summary

AuthError::TokenRefreshFailed(String) currently combines definitive OAuth refresh-token rejection with transient request, parse, and provider failures. try_refresh_or_reauth() then maps the whole variant to AuthorizationRequired, so a temporary provider failure can incorrectly prompt users to sign in again.

This change:

• adds TokenRefreshRejected for OAuth invalid_grant;
• maps only AuthorizationRequired and TokenRefreshRejected to reauthorization;
• keeps temporarily_unavailable, transport, parse, and other failures as retryable TokenRefreshFailed;
• returns AuthorizationRequired directly when no refresh token exists.

Tests

• cargo test -p rmcp --all-features invalid_grant_refresh_requires_reauthorization
• cargo test -p rmcp --all-features temporary_refresh_failure_does_not_require_reauthorization
• cargo test -p rmcp --all-features refresh_token_returns_error_when_no_refresh_token
• cargo clippy -p rmcp --all-features --lib --tests

The three focused tests pass. Clippy passes with two pre-existing sse_stream::from_byte_stream deprecation warnings.

[DaleSeo]

Thanks for the contribution, @stevenlee-oai. I have a quick comment and we should address the linting errors to merge this.

[DaleSeo]

Can we update this public doc about the new error?

[DaleSeo]

@stevenlee-oai The linting errors will be gone once you rebase!

[alexhancock]

@stevenlee-oai do you mind rebasing this and addressing #963 (comment)? Then we can get the change in. Thanks!

[alexhancock]

Just needs a rebase to fix linting and we can merge