fix: close Android token-refresh connections on every exit

[OskarEichler]

Fixes

• Disconnect both Fetch and optional WebSocket HttpURLConnections in finally blocks.
• Close non-2xx error streams and preserve existing success/failure fallback behavior.

Compatibility / breaking changes

• No public API or behavior break intended.

Verification

• Eight compiled Kotlin cases pass: both implementations on success, non-2xx, response-code failure and body-read failure. All eight fail their cleanup assertions on the baseline.
• Android example builds pass; synthetic connections isolate resource lifecycle without contacting real refresh endpoints.

Fixes #204.

Changes were reviewed against upstream 627c77e. No test/spec files were added or modified. Release/version selection is left to the maintainers.

Consumer verification

All nine independent PR source overlays pass TypeScript. The combined fixes were backported to the existing 1.6.1 package without upgrading its dependency constraints. Both Android/iOS app variants, four production Metro bundles, 13 web builds, four extension builds and app lint pass. The installed artifact is immutable and its 269 non-metadata files match the build-verified candidate.

[vercel]

@OskarEichler is attempting to deploy a commit to the Margelo Team on Vercel.

A member of the Team first needs to authorize it.