Function classify_refresh_token_error 

fn classify_refresh_token_error(e: RefreshTokenError) -> RefreshErrorKind

Classify a pkce::refresh_token failure for the broker’s RefreshErrorKind — NoRefreshToken/Rejected in the 4xx range mean the credential itself is the problem (only a fresh muxbus.login fixes it) except 408/429, which mean the request itself was throttled or timed out, not that the refresh_token was rejected — treating those as permanent would strand the credential in NeedsReauth past a temporary rate limit (reagent P2 on #2275). Everything else (network blips, 5xx, response parse failures) is worth retrying on the next sweep tick.