[codex] fix OAuth refresh resource

[tiankaima]

Summary

• Send the OAuth resource indicator during refresh-token grants.
• Preserve the existing credential save path so rotated refresh tokens replace cached tokens.

Root Cause

golang.org/x/oauth2 TokenSource cannot attach extra refresh grant parameters. Without resource, production can issue an opaque access token that REST endpoints reject.

Validation

• go test ./internal/auth ./internal/api ./internal/cmd/authcmd
• go build -o ./life-ustc ./cmd/life-ustc
• Manual mock flow: opaque cached token -> 401 -> resource-bound refresh -> retried todo request succeeds