- Parse JWT 'exp' claim to track token expiry (token_expires_at)
- Proactively refresh Bearer tokens 1 hour before expiry in
ensure_authenticated()
- Refresh response without expires_in now falls back to JWT exp for
expiry derivation
- Support custom refresh_path via bearer auth_config whitelist
- Unify 401 fallback: all bearer types (including Sub2API) now go
through _refresh_bearer_token() instead of separate old path
- Remove dead _is_sub2api_bearer() / _refresh_sub2api_bearer_token()
- Add 2 new tests: refresh_path override + JWT exp backfill
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
