MetadataService does not support OAuth credentials properly

Describe the bug

The MetadataService does not properly handle OAuth credentials and Keychain credentials. For OAuth credentials, it only uses the partial credential body (client_id, client_secret) but ignores the OAuth token data (access_token, refresh_token) stored in the separate oauth_token association. Additionally, OAuth tokens are not refreshed before use, potentially leading to expired token usage.

Version number

Current development version on branch 3359_keychain_credentials for Keychain Credentials, but main for regular credentials.

Discovered while reviewing https://github.com/OpenFn/lightning/pull/3451

To Reproduce

1. Create a job with an OAuth credential
2. Attempt to request metadata for the job via the Inspector
3. The MetadataService will only receive the credential body (client_id,
   client_secret) but not the OAuth token data (access_token, refresh_token)
4. Adaptor receives incomplete credential configuration
5. For keychain credentials, the current fallback clause added in PR #3451
   prevents errors but provides no meaningful functionality

Expected behavior

• OAuth credentials: Should use Lightning.Credentials.Resolver (once it's merged) credential + token data, with token refresh if needed
• Keychain credentials: Won't be supported since there is no dataclip context for resolution, #3451 address this with a fallback clause.
• Basic credentials: Should continue working as before

We really need to test this thoroughly, and hunt down any places that use a credentials body.

Start by tracing MetadataService requests from the Inspector and inspect how credential bodies are passed to the adaptor. Read Lightning.Credentials.Resolver and the credential and oauth_token associations, then review PR #3451's fallback behavior. Done means basic credentials still work, OAuth token data is resolved and refreshed when needed, and the unsupported keychain case remains explicit and tested.