Refresh Extension Credential

Rotate the presented credential before it expires.

Installation-credential auth only: the extension no longer holds a session to re-mint with, so rotation is how an installation outlives the credential TTL. The old credential stays valid for a short grace window so requests in flight during the swap cannot fail into a sign-out. The flag gate runs here too — turning a user's flag off ends their ability to keep a credential alive.