identity: wire refresh into oauth + e2e flow tests (Phase 2 complete, +3 tests)

exchange now issues an access+refresh pair (RFC 6749 §4.1.4/§5.1) via
token.sx issue_grant; added the refresh grant (§6) delegating to token
rotation. End-to-end: code-exchange → refresh → introspect (active),
refresh-token reuse rejected (invalid_grant), and revoke-then-refresh
blocked by grant cascade. oauth 17/17, 65/65.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 62 / 62 tests passing**
+**Total: 65 / 65 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -8,7 +8,7 @@
 | ✅ | token | 18 | 18 |
 | ✅ | registry | 9 | 9 |
 | ✅ | api | 10 | 10 |
-| ✅ | oauth | 14 | 14 |
+| ✅ | oauth | 17 | 17 |
 
 
 Generated by `lib/identity/conformance.sh`.