fix(crm-agent): mcp_auth_proxy refresh based on token exp, not wall-clock

[carvychen]

Summary

User caught a 401 in Claude Code through the proxy:

```
你的访问令牌已过期(过期时间 04:18:55 UTC,当前 04:26:01 UTC)
```

Token had expired ~7 min ago, but the proxy was still serving it.

Root cause

`mcp_auth_proxy.py` cached the token on first fetch and refreshed when "more than 45 min has passed since we fetched". That's a proxy for "token is fresh" — it breaks when `az account get-access-token` returns its own near-expiry cached token. Our 45-min countdown then starts on a token that's already aged 50+ min, and we serve it for the remaining ~10 min before it expires; the next ~35 min we keep serving an expired token because our countdown hasn't elapsed.

Fix

Refresh decision now based on the token's actual `exp` claim, not on when we fetched:

```python
if _token_cache and _token_exp(_token_cache) - time.time() > 60:
return _token_cache

else: re-fetch from az

```

Plus a safeguard: if `az` itself returns a near-expiry token (MSAL refresh wedged), fail loud with `az logout && az login` guidance instead of silently serving a bad token.

Test plan

• Syntax clean
• Parser correctly extracts exp from a real Foundry-audience JWT — `exp - now` matches `az account get-access-token --query expiresOn` to within sub-second
• Manual: leave proxy running >1h, send a request after the original token's exp time, observe fresh fetch + 200 (instead of 401)

🤖 Generated with Claude Code