Add branch coverage tests for OAuth metadata and refresh handling

[SoldierSacha]

Summary

• add a TokenExchangeProvider test that ensures metadata discovery stops when a non-authoritative response is received
• add a TokenHandler test that exercises the refresh-token dispatch path and adjusts imports for the new assertions
• add a TokenExchangeProvider test that retries metadata discovery after receiving an invalid metadata document, covering the ValidationError branch

Testing

• python -m coverage run -m pytest tests/unit/client/test_oauth2_providers.py::test_token_exchange_request_token_retries_after_invalid_metadata tests/unit/client/test_oauth2_providers.py::test_token_exchange_request_token_stops_on_non_authoritative_response tests/unit/server/auth/test_token_handler.py::test_handle_route_refresh_token_dispatches_to_handler

---

Codex Task