feat(hub): OAuth tokens refresh ahead of expiry and Settings offers sign-in again (CL-8592)

[TheGreatAxios]

Summary

A Codex or xAI credential minted by signing in carries an access token that lapses in under an hour. Stock Interchange has no serving-time refresh hook, so the token simply fails the next inference call. The hub now renews these credentials on a timer, ahead of expiry, and pushes the fresh material to running sidecars. Settings → Credentials offers "Sign in again" for the case a refresh can no longer save.

Design

• @corbits/oauth-core's hub export gains createOAuthTokenRefresher. Each tick claims due oauth_token rows (FOR UPDATE SKIP LOCKED, due-ness re-checked under the lock, so two hubs never double-refresh), calls the provider's refresh, and writes the new material through the same path the login flow uses.
• The provider is matched to a credential by the registered provider key the library records in credential metadata (oauthProvider) at persist time; the stock provider row is host-named and per-tenant, so it cannot identify a registry entry.
• onRefreshed fires the stock pushSourceUpdates exactly as the stock credentials route does after a secret rotation, so running sidecars get the rotated secret.
• The refresher starts next to the cron ticker and shares its lifecycle. Every failure — a refusing token endpoint, a failed push — is reported through reportError.
• Settings reuses the onboarding login flow (startProviderLogin/readProviderLogin) through useMutation/useQuery; re-signing in files the tokens under the same credential name, so offerings keep pointing at the same row.

Credentials written before this change carry no oauthProvider metadata and are not refreshed; "Sign in again" files them correctly.

Changes

• apps/hub/package.json: pin @corbits/oauth-core to the refresher. This is the library branch head (f818dcb) until Refresh OAuth tokens ahead of expiry corbits-oauth-core#7 merges; it moves to the merged sha then.
• apps/hub/src/server.ts: refresh on both providers, the refresher started in the Corbits block, pushSourceUpdates from onRefreshed.
• apps/web/src/settings: "Sign in again" on an oauth_token row, plus its strings.

Testing

bun run check green. The refresh decisions themselves are covered by unit tests in the library PR.

[linear-code]

CL-8592