Harden refresh token rotation for client retries

[dsghi]

Summary

• Harden OAuth refresh token rotation with a short idempotent replay marker for client retry/restart races.
• Preserve legitimate refresh tokens on wrong-client attempts and slide upstream vault TTL on successful refresh/replay.
• Document the Codex retry behavior, dependency audit commands, PR Bump Microsoft.AspNetCore.DataProtection and System.Security.Cryptography.Xml #19 DataProtection context, and ignore local .serena/ metadata.
• Patch Azure DataProtection helper packages to latest patch versions and update stale package comments.

Validation

• git diff --check
• dotnet test devbrain.slnx
• dotnet list devbrain.slnx package --vulnerable --include-transitive
• dotnet list devbrain.slnx package --outdated --highest-patch