Controller access-token rejection discards enrollment before attempting silent refresh #245

An enrolled desktop can be forced to sign in again when the controller rejects its current OIDC access token, even though its refresh credentials may still be usable.

Observed on macOS with Agent Desktop v0.5.0. Silent token refresh had succeeded earlier. About 80 minutes after a successful refresh and connection, the controller logged:

OIDC access token rejected
error=OIDC UserInfo endpoint rejected access token
closing stream after OIDC access token revalidation failed

The daemon then logged:

controller rejected the device identity; removed local identity and restarting enrollment

The timing is consistent with ordinary access-token expiry, but the controller's generic logging does not establish the precise reason for rejection. The recovery problem can be reproduced independently of that cause.

To reproduce in an isolated test:

1. Start an enrolled daemon with saved access and refresh credentials.
2. Have the controller return gRPC Unauthenticated when opening or reading its stream.
3. Keep the OAuth refresh endpoint available and willing to issue fresh credentials.

Actual behavior: the daemon removes the local identity and starts enrollment without first attempting a silent refresh. The same destructive recovery branch is present in v0.6.0.

Expected behavior: attempt a forced refresh and reconnect before discarding enrollment, including when the local expiry deadline has not elapsed. Persist rotated credentials and preserve enrollment across transient refresh failures. Re-enroll if the refresh grant is rejected or the controller still rejects refreshed credentials; avoid an unbounded refresh loop.

Related: #113 covers transient failures during token refresh. This is the separate path where the controller rejects an existing access token before a refresh is attempted.

Proposed fix: #241. Its five regression tests exercise the actual session loop against isolated OAuth and gRPC services and fail against the original behavior. Native macOS validation with a signed build remains pending.