feat(cron): add OAuth token refresh background job

Implement automatic token refresh mechanism for CPA providers (Codex,
GeminiCLI, Antigravity, ClaudeCode) with the following features:

- Periodic refresh of expiring tokens based on configurable interval
- Redis event queue processing for on-demand token refresh
- Retry logic with exponential backoff for transient failures
- Automatic key deactivation on non-retryable errors
- Provider-specific OAuth token refresh implementations
- Sync service integration to update providers after refresh

cmd/server/main.go

@@ -194,6 +194,18 @@ func main() {
 	cleanerCtx, cancelCleaner := context.WithCancel(context.Background())
 	defer cancelCleaner()
 	go logCleaner.Start(cleanerCtx)
+	tokenRefresher := cron.NewTokenRefresher(
+		db,
+		rdb,
+		syncService,
+		time.Duration(cfg.TokenRefresh.IntervalSeconds)*time.Second,
+		time.Duration(cfg.TokenRefresh.RefreshSkewSeconds)*time.Second,
+		cfg.TokenRefresh.BatchSize,
+		cfg.TokenRefresh.MaxRetries,
+	)
+	tokenCtx, cancelToken := context.WithCancel(context.Background())
+	defer cancelToken()
+	go tokenRefresher.Start(tokenCtx)
 
 	adminService, err := service.NewAdminService()
 	if err != nil {