OAuth request failure retains token and authenticated session

**I experienced...**

After an OAuth request fails, the client opens the login dialog but retains the previous access token and only changes its UI state to `DISCONNECTED`. The normal disconnect path is not run, so the lobby and chat connections, reconnect policy, and authenticated session data are not cleaned up.

Pioneer reads `oauth_flow.token()` directly when it is launched, so retaining that token makes it possible for a later launch path to forward an expired credential.

**How to reproduce**

1. Start with an authenticated client and a populated OAuth access token.
2. Cause the OAuth token request to fail, for example by making the token endpoint unavailable when the refresh timer runs.
3. Observe that the login dialog opens.
4. Observe that `OAuth2Flow.token()` still returns the previous token and `ClientWindow.disconnect_()` was not called.

**I expected...**

An OAuth request failure should invalidate the access token, run the normal disconnect cleanup, disable automatic relogin for that failure, and then prompt for a fresh login.

**Where the bug is / What should be done**

`OAuth2Flow.on_request_failed` stops expiration checks without clearing the token. `ClientWindow.on_login_attempt_failed` assigns the disconnected state directly instead of invoking the existing disconnect path.

This is a deterministic state-management bug. Whether it accounts for the old access tokens seen in server logs still requires confirmation from deployed logs.

Start at OAuth2Flow.on_request_failed and ClientWindow.on_login_attempt_failed, then trace OAuth2Flow.token and the existing ClientWindow.disconnect_ path. Reproduce a failed token request and verify that the token is invalidated, normal cleanup runs, automatic relogin is disabled for the failure, and a fresh login is prompted.

Written by the indexing model from the issue text.