Issue #3611129: Add support for refresh tokens

Previously storeAccessToken() kept only the bare access token string and discarded the refresh token and expiry, so once Strava's 6-hour access token expired users had to reauthorize.

Store the full token set (access token, refresh token and expiry) and refresh transparently when the access token has expired, writing back the rotated refresh token that Strava returns. Authenticated users' tokens move to a durable key/value store keyed by uid so background processes such as cron can refresh them; anonymous users keep session-scoped tempstore storage. Legacy bare-string tokens are still read.

Also update the scope-change token invalidation to clear the new store, add the missing config schema for strava_configuration.settings, and add a kernel test covering storage, refresh, rotation and legacy tokens.

Closes #3611129