Refresh the calling token: a new secret and a fresh 30-day expiry

Tokens expire after at most 30 days. Refreshing keeps the same token (id, name, and any apps an agent connected with it) but returns a new secret in token — the only time it is shown — and a new expires_at. The previous secret keeps working for 5 minutes so in-flight requests don't fail; store the new one straight away. An expired or revoked token can't refresh.