identity: wire refresh into oauth + e2e flow tests (Phase 2 complete, +3 tests)

exchange now issues an access+refresh pair (RFC 6749 §4.1.4/§5.1) via
token.sx issue_grant; added the refresh grant (§6) delegating to token
rotation. End-to-end: code-exchange → refresh → introspect (active),
refresh-token reuse rejected (invalid_grant), and revoke-then-refresh
blocked by grant cascade. oauth 17/17, 65/65.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,12 +1,12 @@
 {
   "language": "identity",
-  "total_pass": 62,
-  "total": 62,
+  "total_pass": 65,
+  "total": 65,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":18,"total":18,"status":"ok"},
     {"name":"registry","pass":9,"total":9,"status":"ok"},
     {"name":"api","pass":10,"total":10,"status":"ok"},
-    {"name":"oauth","pass":14,"total":14,"status":"ok"}
+    {"name":"oauth","pass":17,"total":17,"status":"ok"}
   ]
 }