fix: auto-retry on 403 bearer-invalid after idle

[leecoder]

Problem

After a period of inactivity, the first API request fails with:

Kiro Error: 403 - The bearer token included in the request is invalid.

The token in the plugin DB matches the kiro-cli token, is not expired, and kiro-cli whoami succeeds. This is a server-side bearer invalidation that resolves on the next attempt. Users currently have to manually retry or do a full logout/login cycle.

Related: #82

Solution

On the first encounter of a 403 with "bearer token included in the request is invalid", the plugin now:

1. Forces a token refresh (kiro-cli sync -> if newer token available, use it; otherwise OIDC refresh)
2. Retries the same request transparently (user sees no error)

If the retry also fails with bearer-invalid, the existing permanent-failure classification applies unchanged.

Changes

• src/core/request/request-handler.ts: Added inline bearer-invalid detection before the error-handler, with a one-shot forceRefresh + continue
• src/core/auth/token-refresher.ts: Added forceRefresh() method that attempts CLI sync first, then falls back to OIDC refresh
• src/core/request/error-handler.ts: Added bearerRetried context flag and forceRefresh return field for defense-in-depth (error-handler path)

Testing

• Reproduced on v1.11.2 with IAM Identity Center auth after ~2-10 hour idle periods
• After patch: 403 is silently retried and succeeds on second attempt without user intervention
• No behavioral change for other error types (429, 400, 500, permanent 403s like suspended accounts)