Function transition_token 

pub fn transition_token(
    status: TokenStatus,
    event: TokenLifecycleEvent,
    refresh_available: bool,
) -> TokenStatus

Deterministically advances a token lifecycle on a discrete event.

The refresh-unavailable guard blocks a NeedsRefresh credential from becoming Active when no refresh token is present, matching the fail-closed behaviour the routing layer relies on.