YM-Android7

Implement parity with iOS #3867: atomically persist access/refresh credentials and expiry metadata, migrate historical access-only tokens conservatively, serialize refresh, refresh on launch/foreground and before access expiry, and retry authenticated requests once after rejection. Persist replacements before reusing grants; stop retrying invalid_grant and back off temporary failures. Use current credentials for WebSocket and push registration, and revoke the current server session family on logout. Routine refresh must never read the user-presence-protected passid, infer direct authority, or extend identity lifetime. Advertise the Android refresh capability and keep older native compatibility intact. Include deterministic session tests and an Android build; physical-device rotation/push validation is a separate acceptance step.