Handle stale MCP OAuth refresh tokens

[ejsmith]

Summary

• allow recently rotated OAuth refresh tokens to be reused during a configurable 60-minute grace period
• persist the original rotation time so the grace window stays bounded across repeated and multi-generation stale refreshes
• preserve grant-family revocation for suspended tokens, legacy spent tokens without a rotation timestamp, and reuse after the grace period
• add focused concurrency, stale-generation, legacy-record, expiry, and serialization coverage

Why

Codex can retain stale MCP OAuth refresh-token generations across active sessions or processes. Exceptionless previously treated the first stale refresh as replay and revoked the entire grant family, turning a recoverable client race into persistent invalid_grant failures on MCP startup.

This keeps refresh-token rotation in place while adding a bounded compatibility window for legitimate client races. Set OAuthServer:RefreshTokenReuseGracePeriodMinutes to 0 to retain strict single-use behavior.

Verification

• dotnet build tests/Exceptionless.Tests/Exceptionless.Tests.csproj --no-restore --verbosity minimal
• OAuth endpoint tests: 63 passed
• OAuth token serialization tests: 1 passed

Breaking changes

None.

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.Core	73%	65%	9509	➖
Exceptionless.AppHost	38%	40%	139	❌
Exceptionless.Insulation	23%	23%	205	❌
Exceptionless.Web	84%	67%	6935	✔
Summary	77% (22554 / 29481)	65% (10369 / 15870)	16788	✔