Add coverage for OAuth discovery redirects and refresh tokens

[SoldierSacha]

Summary

• add a redirect response test to ensure OAuth discovery stops on non-success responses below 400
• cover the refresh-token case where the scope parameter is omitted to exercise the handler branch

Testing

• uv run pytest tests/unit/client/test_oauth2_providers.py::test_client_credentials_request_token_stops_on_redirect tests/unit/server/auth/test_token_handler.py::test_handle_route_refresh_token_without_scope -n0

---

Codex Task