Advertise refresh-token grant in OAuth client metadata

[baggiiiie]

Summary

Atlassian's /authv2 flow requests offline_access, but Executor's OAuth client metadata only declares authorization_code, which causes the client to be rejected.

this change adds refresh_token to hosted and local client metadata, matching what Executor already declares during dynamic client registration.

before

atlassian-before.mp4

after

atlassian-after.mp4

Linked issue

Fixes #1909

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• TURBO_TEST_CONCURRENCY=2 bun run test — 39/39 tasks passed
• manual — Atlassian /authv2 connection succeeds
• e2e — MCP OAuth · advertised CIMD starts authorization without dynamic registration — recording

Checklist

• Added a changeset (bun run changeset), or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.