Refresh Oauth

Initiate a manual IdP refresh for the current user.

Returns: JSON with authorization_url (frontend redirects to it) and the CSRF state token (for symmetry with /auth/{provider}/login).

Raises: HTTPException(400): user is password-auth, or has no usable auth_provider (a legacy null from before #361, or the last provider was unlinked). The pointer is set again only by a sign-in through the identity the account was created with, once its link is established (#1875, auth.roles) — never by linking a provider, nor by signing in through one attached later, however old its link. HTTPException(429): more than 1 request in the current minute window. Retry-After header is set on the response. HTTPException(500): OAuth managers not initialised, or required environment variables missing.