Execute all steps in the auth flow using a plain reqwest client
(not the scanner’s HttpClient, to avoid circular dependency).
Returns the live credential ready for injection.
Spawn a background task that re-executes the auth flow before the token
expires. Writes the new token into cred.value so all in-flight requests
automatically pick it up on the next read.