fix(auth): unify refresh checks and error handling

[DaleSeo]

Motivation and Context

PR #1232 added CredentialStore::acquire_refresh_guard. Three refresh behaviors ended up depending on whether a store returns a guard.

• The stored client ID is checked only for guarded stores.
• The stored granted scopes are treated as authoritative only for guarded stores.
• call_reacting_to_challenges only propagates CredentialStoreError and converts every other refresh error into AuthRequired.

The presence of a guard tells us whether a store can coordinate. It does not tell us whether its contents are trustworthy. For example, a store might return Ok(None) in single-process mode because it does not need a lock. In that case, we would silently skip the client ID check. The trait docs also describe this hook as coordination only, so implementors have no reason to know that validation depends on it.

This PR makes the following changes:

• It applies the client ID check to every store, so mismatches are caught before the refresh token leaves the process.
• It routes refresh scopes through the existing resolve_granted_scopes helper. This follows the same SEP-2350 and RFC 6749 section 5.1 rule already used by the authorization-code path. The current_scopes fallback is used only when no scopes were recorded.
• It maps only AuthorizationRequired to the challenge in call_reacting_to_challenges and propagates every other error. This removes the special handling for CredentialStoreError.

How Has This Been Tested?

Added regression tests

Breaking Changes

None

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed