fix(kiro): prevent expired token refresh stalls

[HanqingAWS]

Summary

• refresh expired Kiro access tokens synchronously before unary or streaming generation
• keep valid near-expiry tokens on the existing non-blocking background refresh path
• coalesce concurrent forced refreshes for the same credential
• release provider-level refresh slots after queued credentials finish
• treat malformed expiry timestamps as expired

Why

When a Kiro access token was already expired, both request paths marked the credential as
needsRefresh but immediately sent the stale token upstream. Kiro then returned:

403: The bearer token included in the request is invalid.

With multiple credentials expiring near the same time, failover selected another expired
credential. The refresh queue also attached global-slot ownership to the first task instead
of the provider queue, so a queued second credential could finish without releasing the
slot. After enough leaked slots, later refreshes never started and all nodes could remain
in “Refreshing” until the service was restarted.

Tests

npx jest tests/kiro-token-refresh.test.js --runInBand

PASS tests/kiro-token-refresh.test.js
Tests: 6 passed, 6 total

The tests cover unary ordering, streaming ordering, the near-expiry background path,
concurrent refresh coalescing, provider refresh-slot release, and malformed expiry values.

Fixes #680