fix(oauth): treat unauthorized_client as a terminal refresh error

[waleedlatif1]

Summary

• Atlassian rejects a revoked or rotated-out refresh token with unauthorized_client, which was missing from the shared terminal refresh-error set
• Without it, a dead Atlassian credential is never dead-flagged: every caller keeps hitting the token endpoint, and the connector reconnect prompt never fires, so Confluence/Jira connectors grind down the failure ladder to auto-disable instead
• Adds unauthorized_client to the set. Under RFC 6749 §5.2 it means the client may not use the refresh grant, which is as persistent as invalid_client (already terminal). The managed Atlassian adapter already classifies it this way
• Google service-account token minting keeps its own code set and is unaffected

Type of Change

• Bug fix

Testing

• Unit test covers the new code; reverting the fix turns it red
• OAuth suites (terminal errors, managed OAuth adapters, credential service) pass; check:audits passes

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 22, 2026 10:08pm UTC

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the new classification is consistent with terminal OAuth refresh failures and is directly unit-tested.

Summary

This PR adds unauthorized_client to the shared set of terminal OAuth refresh errors so affected credentials stop retrying and can enter the existing reconnection flow.

• Documents why the error is considered terminal.
• Adds direct unit coverage for unauthorized_client.
• Adds missing unit coverage for the already-terminal token_revoked code.

_{Reviews (1) · Last reviewed commit: "fix(oauth): treat unauthorized_client as..."}