Handle invalid OAuth token validation responses

[chillardinho]

What

Treat ValidateToken responses with result:false as invalid tokens instead of returning (nil, nil). Also return ErrInvalidToken when the validation response has no user_id.

Why

The Put.io OAuth validation endpoint can return HTTP 200 with a payload like:

{"result":false,"token_id":null,"token_scope":null,"user_id":null}

The current client only decodes user_id, so callers see (nil, nil) and have to guess whether the token is invalid or the response is malformed. Returning a sentinel error gives callers a reliable path for stale/invalid tokens.

Compatibility

The ValidateToken signature is unchanged. Valid responses still return the user ID. Invalid or missing-user responses now return ErrInvalidToken instead of (nil, nil).

Tests

• go test ./...