Returns whether the access token has expired, comparing the latest stored
expiresAt against the current time at the moment it is called. Both the
tokens and the clock are read at call time, so a reference captured in an
earlier render stays accurate after a refresh. Reading the clock does not
trigger a re-render, so call this in an event handler or effect rather than
during render. Returns false when there are no tokens.
Refresh via the OAuth refresh_token grant. When there is no refresh token,
core clears the stored tokens, logs the user out, and this resolves null.
Rejects on transient failures (network, 5xx, 408, 429), leaving tokens
unchanged so the call can be retried. Also rejects when the server rejects
the refresh token itself (other 4xx); core clears the tokens and logs out
first, so check tokens before retrying.
Revoke the tokens at the OAuth server, clear them locally, and log out.
The stored OAuth tokens, or null when not logged in via OAuth. The
refresh token is omitted — core retains it internally for refresh.
The current OAuth token state, plus actions to refresh and revoke it.