feat: support upstream token refresh

backend/app/services/auth_config.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+MASK = "***"
+SECRET_KEYS = {"password", "token", "refresh_token", "access_token", "auth_token", "key", "secret"}
+
+AUTH_CONFIG_ALLOWED_KEYS = {
+    "none": set(),
+    "bearer": {"token", "refresh_token", "expires_in", "token_expires_at"},
+    "new_api_token": {"token", "user_id", "new_api_user", "provider"},
+    "nox_token": {"token", "user_id", "new_api_user", "provider"},
+    "api_key": {"key", "header"},
+    "cookie": {"cookie_string", "new_api_user", "user_id", "provider"},
+    "login_password": {
+        "email", "password", "login_path", "username_field", "new_api_user", "user_id", "provider",
+        "token", "refresh_token", "expires_in", "token_expires_at",
+    },
+}
+
+
+def mask_auth_config(auth_type: str, cfg: dict) -> dict:
+    masked = {}
+    for k, v in cfg.items():
+        if k.lower() in SECRET_KEYS and v:
+            masked[k] = MASK
+        else:
+            masked[k] = v
+    return masked
+
+
+def normalize_auth_config(auth_type: str, cfg: dict) -> dict:
+    allowed = AUTH_CONFIG_ALLOWED_KEYS.get(auth_type)
+    if allowed is None:
+        return cfg
+    return {k: v for k, v in cfg.items() if k in allowed}