[rmcp] Notify credential stores when a refresh token is rejected

[mzeng-openai]

Summary

A provider can reject a refresh token with invalid_grant, but the credential store currently has no callback to retire that token. Later calls can load it again and repeat the failed exchange.

This adds an optional CredentialStore::on_refresh_token_rejected callback at the shared refresh boundary. It receives the credentials used for the exchange while the refresh guard is still held. The default is a no-op, so existing stores keep their behavior. Callback failures propagate as storage errors; other refresh failures do not invoke the callback.

Key review points:

• crates/rmcp/src/transport/auth.rs: the callback must not reacquire the refresh guard or overwrite credentials that have been replaced.

The branch starts from RMCP 3.2.0 so downstream clients can test this hook without taking an unrelated SDK upgrade.

Test Plan

• Command: cargo test -p rmcp --lib --features auth,client,transport-streamable-http-client,reqwest transport::auth::tests:: passed all 185 tests.
• Tests cover the attempted credential snapshot, guard lifetime, callback failure, transient errors, and unchanged default behavior.
• Command: git diff --check passed.