- Custom base_url (e.g. claude.nekos.me) points at third-party mirrors;
  the refresh exchange targets official Anthropic OAuth, which neither
  knows the mirror's credentials nor returns usable tokens
- Gate in nextRefreshCheckAt (schedule), shouldRefresh (decision), and
  refreshAuthForRequest (hard stop covering 401-triggered path)
- Executor-key delegation test keeps official host fixture

Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>