fix(auth): refresh cached tokens without expiry

[y4ho0]

Description

Closes #904.

Encrypted token storage now treats a cached token with no expiration time as a cache miss. This lets the OAuth authenticator obtain a fresh token instead of reusing the same access token indefinitely and producing permanent per-scope 401 responses.

Cached tokens with a known expiration time continue through the existing yup-oauth2 freshness and refresh logic unchanged.

Dry Run Output: Not applicable; this changes local OAuth token-cache behavior and does not create a Discovery API request.

Validation

• cargo fmt --all -- --check
• cargo test -p google-workspace-cli token_storage::tests
• cargo test --workspace -- --test-threads=1 (785 tests passed)
• cargo clippy -- -D warnings -A clippy::collapsible_match
• cargo clippy -- -D warnings is currently blocked on unchanged main-branch code at helpers/script.rs:173 by the Rust 1.97 collapsible_match lint

Checklist:

• My code follows the AGENTS.md guidelines (no generated google-* crates).
• I have run cargo fmt --all to format the code perfectly.
• I have run cargo clippy -- -D warnings and resolved all warnings. See the documented pre-existing main-branch warning above; the changed code is clean.
• I have added tests that prove my fix is effective or that my feature works.
• I have provided a Changeset file to document my changes.

[changeset-bot]

🦋 Changeset detected

Latest commit: b7ac01b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.