feat: restore OAuth token auto-refresh with multi-account support

Restores token-refresh.ts that was deleted in 35356dd. Now works
with multi-account token rotation:
- Refreshes tokens from ~/.claude/.credentials.json (account 0)
  and ~/.claude-accounts/{n}/.credentials.json (account 1+)
- Updates token-rotation memory and .env on refresh
- Syncs credentials to session directories
- 5-min check interval, refreshes 30 min before expiry
- forceRefreshToken() export for 401 recovery

src/token-rotation.ts

@@ -208,6 +208,22 @@ export function getAllTokens(): {
   }));
 }
 
+/** Update the access token value for a specific index (after OAuth refresh). */
+export function updateTokenValue(index: number, newAccessToken: string): void {
+  if (index < 0 || index >= tokens.length) {
+    logger.warn(
+      { index, total: tokens.length },
+      'updateTokenValue: index out of range',
+    );
+    return;
+  }
+  tokens[index].token = newAccessToken;
+  logger.info(
+    { index, masked: `${newAccessToken.slice(0, 20)}...${newAccessToken.slice(-4)}` },
+    'Token value updated after OAuth refresh',
+  );
+}
+
 /** Diagnostic info. */
 export function getTokenRotationInfo(): {
   total: number;