Function refresh_pm_oauth_token 

pub async fn refresh_pm_oauth_token(
    provider: Provider,
    refresh_token: &str,
    stored_client_id: Option<&str>,
) -> Result<ProviderToken, AuthError>

Exchange a stored refresh token for a fresh access token via the PM provider’s OAuth grant_type=refresh_token endpoint. Linear PKCE grants reuse their stored client ID; legacy rows fall back to the configured client credentials.

The returned token carries login: None; callers should preserve the prior login.

Errors

Returns AuthError::UnsupportedProvider for non-PM providers, AuthError::CommandUnavailable when client credentials are absent, and AuthError::OAuthRequest when the network request or token endpoint rejects it.