Summary

Fixes #2034

saveTokens() errors during token refresh are silently caught and discarded, because saveTokens() sits inside the same try/catch that handles refreshAuthorization() network errors. When an authorization server uses rotating refresh tokens, this is destructive: the AS has already invalidated the old RT, so losing the new tokens leaves the client permanently locked out.

Changes

• Move newTokens declaration outside the try block
• Move saveTokens(newTokens) after the catch block so it is no longer swallowed by the refreshAuthorization error handler
• Add a test that verifies saveTokens errors propagate to the caller

Root cause

// BEFORE (lines 766-786)
try {
    const newTokens = await refreshAuthorization(...);
    await provider.saveTokens(newTokens);  // ← inside try
    return 'AUTHORIZED';
} catch (error) {
    // This catches BOTH refreshAuthorization AND saveTokens errors
    if (!(error instanceof OAuthError) || ...) {
        // silently swallowed — saveTokens failure lost here
    }
}

// AFTER
let newTokens;
try {
    newTokens = await refreshAuthorization(...);
} catch (error) {
    // Only catches refreshAuthorization errors now
}

if (newTokens) {
    await provider.saveTokens(newTokens);  // ← propagates naturally
    return 'AUTHORIZED';
}

Test

Added test case: "should propagate saveTokens errors after successful token refresh" — verifies that a saveTokens rejection is not caught by the refresh error handler.

All 365 existing tests continue to pass.