fix(mcp): refresh expired OAuth tokens deterministically

[SmartBoostKG]

Summary

• reload expired stored MCP OAuth tokens with a negative TTL instead of zero
• prevent the SDK's inclusive expiry check from briefly accepting stale tokens on coarse Windows clocks
• cover both absolute expires_at and legacy file-mtime reconstruction paths

Without this boundary fix, an expired bearer token can be sent first, receive 401, and fall into full browser authorization even when a refresh token is available.

Verification

• uv run --extra dev --frozen pytest tests/tools/test_mcp_oauth*.py -q — 102 passed, 1 skipped
• uv run --extra dev --frozen ruff check tools/mcp_oauth.py tests/tools/test_mcp_oauth_cold_load_expiry.py — passed
• reproduced against an expired Trello MCP token: refresh endpoint returned 200, followed by a successful MCP connection without browser authorization

[alt-glitch]

This was generated by AI during triage.

Related: #62309 already carries this exact clamp (expires_in -> -1 on both the expires_at and legacy-mtime paths) as its Fix A, plus a proactive refresh timer. #67833 fixes the idle-expired refresh from the reconnect side. Flagging so reviewers can consolidate rather than merge overlapping edits to _rebase_expires_in.