Hardens the MCP OAuth refresh path (librefang-kernel::mcp_oauth_provider). Implements the remaining three sub-findings of docs/issues/oauth-refresh-error-body-token-leak.md; the log-sanitization sub-finding already landed in #5526 (closed #5525), which explicitly deferred these. Internal audit.

Changes

• Error classification — try_refresh returned Result<OAuthTokens, String> and load_token collapsed every failure (503, DNS blip, invalid_grant) into Ok(None), which the connection layer reads as "no token, re-auth" — discarding a still-valid refresh token on a transient outage. New RefreshError { Revoked, Transient, Permanent }: 400 invalid_grant -> Revoked (the only re-auth signal, mapped to Ok(None)); 5xx / timeout / transport -> Transient (kept for retry); else -> Permanent. Transient/Permanent surface as the new McpOAuthError::RefreshFailed so the refresh token is retained. Only the short OAuth error code is parsed (as a 'static constant); no token-shaped body field is ever read or logged.
• Single-flight refresh — rotating-refresh-token providers (Google, GitHub Apps, Notion) invalidate the old refresh token on each refresh; concurrent load_token calls that raced past the expiry check both POSTed the same soon-to-be-rotated token, burning a valid session. Added a process-global per-server_url lock (KernelOAuthProvider is stateless and rebuilt per request, so an instance field would not serialize across callers). After acquiring the lock, load_token re-reads expires_at from the vault and returns the peer's freshly-stored token without a second network POST.
• Unwrap removal — find_any_with_refresh now returns the refresh token as a non-optional String, so entry.refresh_token.unwrap() in auth_refresh is gone; the Some(..) arm is the type-level proof.
• Handle the new McpOAuthError::RefreshFailed variant in the exhaustive auth_revoke match (compile-time guard, not silent fallthrough).

Verification

• cargo check -p librefang-kernel -p librefang-api -p librefang-runtime-mcp
• cargo check --workspace --lib
• cargo test -p librefang-kernel --lib mcp_oauth_provider — 24 passed, incl. new:
  • classify_400_invalid_grant_is_revoked
  • classify_503_is_transient
  • classify_400_other_error_is_permanent
  • classify_error_message_does_not_leak_body
  • oauth_error_code_extracts_only_the_code
  • refresh_lock_is_shared_per_server_and_isolated_across_servers
  • refresh_recheck_returns_already_refreshed_token_without_network
  • load_token_expired_without_refresh_token_yields_none
• cargo test -p librefang-api --lib oauth (23) and mcp_auth (34) — passed.
• Clippy on the four changed files is clean. (The 6 errors a local clippy 1.95 reports are all in untouched files — validation.rs, webchat.rs, routes/registry.rs — identical on origin/main; they are CI-pinned-toolchain noise, not introduced here.)

Note on single-flight test

A full end-to-end "two concurrent load_token -> one HTTP call" test cannot run against loopback: try_refresh uses the strict is_ssrf_blocked_url guard, which blocks 127.0.0.1, and no mock-HTTP dev-dependency exists in the kernel crate (none was added — per the "no new deps" constraint). Instead the single-flight guarantee is proven by two faithful unit tests against the real load_token path: the lock map returns the same Arc<Mutex> per server_url (so concurrent refreshers serialize), and the post-lock recheck returns an already-refreshed token without any network call (the exact branch that makes the second concurrent caller skip the HTTP POST).

Closes #5608.