Refresh expired OAuth access tokens

[Chel-Tbl]

Summary

• add a shared OAuth refresh helper for expiring provider access tokens
• refresh accounts before returning them from getAccount and getAccountByProvider, which is the path used by connected toolkits
• support Google, Discord, GitHub, Spotify, Strava, and Twitter refresh-token flows while leaving providers without refresh config unchanged

Verification

• tsc --noEmit --pretty false
• targeted prettier --check for changed files
• SKIP_ENV_VALIDATION=1 next build

Closes #191