fix: improve error logging and remove token secret from logs

[DaleSeo]

Motivation and Context

Quick follow-up to #680 to make a few small fixes/improvements:

• debug!("refresh token: {:?}", refresh_token) was logging the refresh token secret, which should never appear in logs
• When try_refresh_or_reauth catches TokenRefreshFailed, the original reason was discarded from both the error and the log, making refresh failures harder to diagnose
• The skip-expiry-check path when token_received_at is None was correct but non-obvious without a comment

How Has This Been Tested?

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context