smcli: refresh-token support - sessions no longer die after ~1h

The login grant requested offline_access but the issued refresh_token
was parsed and discarded: every access token died with the ~1h
Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until
a human re-logged in.

- persist refresh_token in state (0600, same file)
- add refresh grant (grant_type=refresh_token, rotated token saved)
- on 401 for authed calls: refresh once, retry the request
- persistTokens() keeps the rest of the state intact

Build verified in golang:1.23-alpine (vet + gofmt clean). After
deploy, one `sm login` issues a refresh token (~30d, rotated on use)
and sessions self-heal from then on.

cli/cmd/smcli/api.go

@@ -23,6 +23,7 @@ type Client struct {
 	Password string
 
 	AccessToken  string
+	RefreshToken string
 	KDFType      int
 	KDFIter      uint32
 	KDFMemory    uint32
@@ -72,11 +73,49 @@ func (c *Client) api(method, path string, body any, auth bool) ([]byte, error) {
 		return nil, err
 	}
 	if resp.StatusCode >= 300 {
+		// access token expired: refresh once and retry (never for the
+		// identity endpoints themselves, which manage their own tokens)
+		if resp.StatusCode == 401 && auth && c.RefreshToken != "" && !strings.HasPrefix(path, "/identity/") {
+			if rerr := c.refresh(); rerr == nil {
+				return c.api(method, path, body, auth)
+			}
+		}
 		return out, fmt.Errorf("%s %s: HTTP %d: %s", method, path, resp.StatusCode, truncate(string(out), 200))
 	}
 	return out, nil
 }
 
+// refresh exchanges the persisted refresh_token for a fresh access token
+// (Vaultwarden rotates the refresh token on every use). Scope must match
+// the original grant (api offline_access).
+func (c *Client) refresh() error {
+	if c.RefreshToken == "" {
+		return errors.New("no refresh token in state; re-login required")
+	}
+	form := url.Values{}
+	form.Set("grant_type", "refresh_token")
+	form.Set("refresh_token", c.RefreshToken)
+	form.Set("client_id", "cli")
+	form.Set("scope", "api offline_access")
+	out, err := c.apiRaw("POST", "/identity/connect/token", form, false)
+	if err != nil {
+		return fmt.Errorf("refresh: %w", err)
+	}
+	var t tokenResp
+	if err := json.Unmarshal(out, &t); err != nil {
+		return err
+	}
+	if t.AccessToken == "" {
+		return fmt.Errorf("refresh failed: %s", truncate(string(out), 200))
+	}
+	c.AccessToken = t.AccessToken
+	if t.RefreshTok != "" {
+		c.RefreshToken = t.RefreshTok
+	}
+	persistTokens(c)
+	return nil
+}
+
 func truncate(s string, n int) string {
 	if len(s) <= n {
 		return s
@@ -170,6 +209,7 @@ func (c *Client) Login() error {
 		return fmt.Errorf("login failed: %s", truncate(payload, 300))
 	}
 	c.AccessToken = t.AccessToken
+	c.RefreshToken = t.RefreshTok
 	return nil
 }