Accept resource-less OAuth refreshes

[AliOsm]

Summary

• allow OAuth refresh-token grants to omit the RFC 8707 resource parameter
• inherit the canonical resource already bound to the rotated refresh token
• continue rejecting explicit mismatched, repeated, and array-shaped resource values

Root cause

Codex 0.144.1 uses rmcp 1.8.0. Its authorization-code exchange includes the MCP resource indicator, but its refresh request omits it. PasteHTML required exactly one resource on every token request, so the otherwise valid refresh token was rejected with invalid_target and Codex requested reauthorization.

Claude Code already includes the MCP URL during refresh and was unaffected.

Impact

Codex can refresh PasteHTML MCP credentials after the one-hour access token expires without requiring the user to reauthenticate. Audience binding remains intact because omitted values are accepted only for an unambiguous refresh_token grant, and Doorkeeper copies the canonical resource from the rotated token.

Validation

• mise exec -- bin/rails test test/integration/oauth_resource_indicator_test.rb test/integration/mcp_agent_journey_test.rb test/integration/oauth_authorization_flow_test.rb
  • 34 tests, 238 assertions, 0 failures
• full Rails suite
  • 443 tests, 2,068 assertions, 0 failures
• RuboCop: 128 files, no offenses
• Brakeman: no warnings
• Bundler audit: no vulnerabilities
• seed replant: passed

The aggregate bin/ci command remains red because the existing Yarn dependency tree contains undici 6.26.0, which is affected by newly published advisories. This PR does not modify JavaScript dependencies.