v3.4.144

Fix refresh_token rotation stranded by accounts-lock contention.

If Google rotates the refresh_token during a refresh call but the accounts lock write then fails (contention/timeout), the rotated token was previously discarded entirely: the stale, already-superseded token stayed in storage, and the next refresh attempt using it would fail and could wrongly flag the account as expired/revoked. The rotated token is now cached (encrypted) as a transient before the lock write, self-healed into storage on the next refresh call, and checked when classifying a failure as a genuine expired/revoked error vs. a rotation race.