Preserve credentials after retryable token refresh failures

[taglia]

Summary

This changes token refresh failure handling so stored credentials are only cleared when the refresh failure indicates invalid or expired credentials.

Retryable failures such as 5xx, 408, 429, or network/unknown errors now preserve the existing credentials and return the error to the caller. This avoids leaving long-running WebDAV sessions permanently logged out after a transient API failure.

Why

A transient 503 during token refresh can currently clear the saved user credentials. After that, all following WebDAV requests fail with Missing credentials, please login first until the container is manually re-authenticated or restarted.

Behavior

• Clear credentials for explicit auth/client failures such as 401/403.
• Preserve credentials for retryable refresh failures such as 503, 408, 429, or missing HTTP status.
• Re-throw the original error either way.

Tests

• Added coverage for auth refresh 401 clearing credentials.
• Added coverage for auth refresh 503 preserving credentials.
• Verified targeted auth/WebDAV tests locally.