fix: refresh expired ID tokens before account switch

[Jeakcey]

Dependency

This is a stacked follow-up to #128. Please merge #128 first; this PR preserves its original commits and authorship. Once #128 lands, the remaining diff is the single follow-up commit daac4b6.

What changed

• Treat an expired or malformed ID token as requiring refresh even when the access token is still valid.
• Refresh the target account before writing it to auth.json from both the main UI and tray paths.
• Persist rotated access and refresh tokens before reporting a missing or invalid ID token, so a single-use refresh token is never lost.
• Serialize rapid tray selections with latest-request-wins behavior.
• Add deterministic synthetic-JWT regression tests; no real credentials or logs are included.

Why

On Windows with Codex desktop 26.820.9563.0, a stored account had an ID token that expired hours earlier while its access token remained valid. Codex Switcher only checked the access token and restored the stale ID token, after which Codex returned 401 and displayed the sign-in screen. PR #128 fixes live-token reconciliation; this follow-up covers the independent partial-expiry path and switch-time refresh.

Checks

• cargo test --manifest-path src-tauri/Cargo.toml: 39 passed
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets: completed; only pre-existing warnings from the fix: preserve rotated auth tokens when switching accounts #128 base
• pnpm build: passed
• pnpm tauri:win build --no-bundle: passed on Windows
• Independent code review: no remaining blocking findings

Manual A to B to A switching was not run inside this active Codex task because the switcher correctly requires Codex to be closed first. The original failure was confirmed from local token expiry metadata and desktop authentication logs without publishing credentials.

Related: #127, #128, #129