Function refresh_with 

pub async fn refresh_with<H, C>(
    http: &H,
    clock: &C,
    refresh_token: &str,
) -> Result<OAuthCredentials, KimiAuthError>
where
    H: KimiHttp,
    C: KimiClock,

Refresh with upstream retry semantics: up to 3 attempts, exponential backoff on 429/5xx, immediate failure on 401/403/invalid_grant.

The caller (ensure_fresh_provider_token) persists the returned credentials — including the rotated refresh token — atomically.