The login grant requested offline_access but the issued refresh_token
was parsed and discarded: every access token died with the ~1h
Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until
a human re-logged in.
- persist refresh_token in state (0600, same file)
- add refresh grant (grant_type=refresh_token, rotated token saved)
- on 401 for authed calls: refresh once, retry the request
- persistTokens() keeps the rest of the state intact
Build verified in golang:1.23-alpine (vet + gofmt clean). After
deploy, one `sm login` issues a refresh token (~30d, rotated on use)
and sessions self-heal from then on.
