fix(auth): preserve OAuth refresh token during reauthentication

Summary

• preserve an existing OAuth refresh token when a re-authentication response omits RefreshToken
• avoid deleting both new-format and legacy keyring refresh-token entries during re-authentication
• add a keyring-backed regression test proving the old refresh token remains retrievable while the access token is updated

Testing

• go test ./internal/oauth2
• go test ./internal/api
• git diff --check

The full ./internal/config package was also run; OAuth/config tests passed, while unrelated Windows-only permission/symlink assertions remain platform-incompatible in this checkout.

Closes #8405 (closed)