fix: retry transient 5xx errors during token refresh

[marcusolsson]

Issue 7 from TODO.md

A single 503 Service Unavailable from the refresh endpoint immediately bubbled up as a fatal error. In distributed systems, transient 5xx errors are common during deployments or brief overloads.

Changes

• Adds attempt parameter (default 1) to refreshAccessTokenInternal.
• On 5xx-class responses with attempt <= 2:
  • Delay: 500ms on first retry, 1500ms on second.
  • Log the retry attempt.
  • Recurse with attempt + 1.
• 4xx client errors are NOT retried (they're deterministic failures).
• refreshInFlight deduplication prevents the thundering-herd problem.

Tests

• Single 503 -> retry once -> success on second call.
• Two consecutive 503s -> fail after exhausting retries.
• 401 -> no retry, immediate failure.

Refs: TODO.md Issue 7