api: report clear error when refresh token is rejected

[NanShanFish]

Problem

rbw sync (and any command that needs to refresh the access token) reports a confusing error when the server rejects the stored refresh token:

rbw sync: failed to sync database from server: failed to parse JSON:
missing field `access_token` at line 1 column 25

Cause: exchange_refresh_token and exchange_refresh_token_async deserialize the response body unconditionally. When the identity server returns an error like {"error":"invalid_grant"} (HTTP 400), serde fails with missing field 'access_token', masking the real cause. This is a common real-world scenario: the refresh token has been revoked or has expired (e.g. after changing the master password), leaving the user without an actionable recovery path.

Relates to #32.

Changes

• src/api.rs: check the response status code before parsing the response in both exchange_refresh_token* functions. On a non-200 response, parse the standard ConnectErrorRes and classify it through a new classify_refresh_token_error helper (consistent with the existing classify_login_error pattern):
  • invalid_grant → new Error::RefreshTokenInvalid
  • invalid_client → Error::IncorrectApiKey
  • otherwise → Error::RequestFailed
• src/error.rs: add Error::RefreshTokenInvalid, with an error message telling users how to recover (rbw purge followed by rbw login).
• Tests: add unit tests and mock HTTP tests for the refresh path (success, invalid_grant, invalid_client).

Result

rbw sync: failed to sync database from server: refresh token is invalid or
has been revoked (the master password may have been changed); run `rbw purge`
and then `rbw login` to re-authenticate

Note: this fix targets doy/rbw upstream; the PR currently lives on the fork.