Function load_valid_token 

pub(crate) async fn load_valid_token(
    mstore: &Arc<Store>,
    scheduler: &RefreshScheduler,
) -> Option<String>

Load a valid (non-expired) access token via the broker, refreshing first if the stored credential is missing/stale. Returns None if no credentials are stored, the token is expired and refresh fails, or the refresh_token is absent — ensure_fresh’s own single-flight guard means this can run concurrently with the broker’s background sweep for the same credential without either one duplicating the other’s refresh attempt.

pub(crate): also used by agent_credentials.rs to authenticate the POST /agents/provision call, which requires the human’s own user-level (PKCE) token, not an agent-bound M2M one.