fix(oauth): restore long-lived ChatGPT MCP access

[teckedd-code2save]

Symptom

The ChatGPT Ground Control app worked immediately after OAuth, then later reported that it no longer had access.

GroundControl access tokens currently expire after one hour. The refresh-token endpoint required client_id on every refresh request, even for public PKCE clients using token_endpoint_auth_method=none.

OAuth 2.0 does not require an unauthenticated public client to repeat client_id in the refresh-token request. The refresh token is already bound to the GroundControl grant/client.

Fix

• refresh_token remains required.
• client_id becomes optional only when the registered client uses token_endpoint_auth_method=none.
• If ChatGPT does send client_id, GroundControl still requires an exact match.
• Any future client using authenticated token-endpoint methods must still identify/authenticate itself.

This preserves the client binding while accepting the public-client refresh shape.

Why existing connections can recover

The previous code rejected a refresh request before rotating or revoking the stored refresh token when client_id was absent. Existing ChatGPT refresh credentials should therefore remain valid after this patch, unless ChatGPT has already discarded the credential and requires a reconnect.

Validation

Adds regression coverage for:

• public client refresh without repeated client_id
• exact match when client_id is supplied
• rejection for authenticated/confidential client methods that omit identity