fix: fall back to valid PAT when OAuth token refresh fails

[jodeleeuw]

Summary

• When a user is set to OAuth but the refresh token is invalid or missing (e.g., they switched to OAuth without completing the flow), token resolution now falls back to their personal access token if one exists and is valid
• Applied in both resolve-token.ts (used by api-data and api-base64) and metadata-block.ts

Test plan

• Set a valid PAT, switch to OAuth without completing the flow, verify data uploads still work using the PAT
• Verify that users with working OAuth tokens are unaffected
• Verify that users with neither a valid PAT nor valid OAuth tokens still get an appropriate error

🤖 Generated with Claude Code