[Client] Implement refresh_token grant + offline_access scope

[soyuka]

Context

When an access token expires, the client must transparently refresh using the stored refresh_token rather than re-prompting the user. Per OIDC/OAuth, offline_access scope is requested at authorize time when the AS advertises it; otherwise the client degrades gracefully (no refresh available).

Scope

• Mcp\Client\Auth\Grant\RefreshTokenGrant.
• Pre-flight check: if expires_at - now() < skew, refresh before sending request.
• Reactive: on 401 with valid refresh token, refresh + retry once.
• Request offline_access scope at authorize time when scopes_supported contains it; otherwise omit.
• If the AS does not advertise offline_access and tokens expire, surface a re-auth signal cleanly (no infinite loop).

Conformance scenarios unblocked

auth/offline-access-scope, auth/offline-access-not-supported.

Dependencies

Blocked by: #319 (need access+refresh tokens from auth code flow), #322 (scope handling).

Acceptance

• Unit tests for proactive + reactive refresh, no-refresh-token degradation, no-offline_access degradation.
• Conformance: 2 baseline scenarios pass.

cc @soyuka