`/oauth2/introspect` invalid compat session / access token is not valid causing problems

**Describe the bug**
MAS is unable to handle introspection endpoint.

```
ERROR http.server.request{otel.kind="server" otel.name="POST /oauth2/introspect" network.protocol.name="http" network.protocol.version="1.1" http.request.meth │
│ od="POST" url.path="/oauth2/introspect" url.scheme="http" http.route="/oauth2/introspect" user_agent.original="Synapse/1.127.1"}:handlers.oauth2.introspection.post{client.id="00000000000 │
│ 00000000SYNAPSE"}: mas_handlers::oauth2::introspection: crates/handlers/src/oauth2/introspection.rs:160: error=invalid compat session
```

Also token not valid

```
ERROR http.server.request{otel.kind="server" otel.name="POST /oauth2/introspect" network.protocol.name="http" network.protocol.version="1.1" http.request.meth │
│ od="POST" url.path="/oauth2/introspect" url.scheme="http" http.route="/oauth2/introspect" user_agent.original="Synapse/1.127.1"}:handlers.oauth2.introspection.post{client.id="00000000000 │
│ 00000000SYNAPSE"}: mas_handlers::oauth2::introspection: crates/handlers/src/oauth2/introspection.rs:160: error=access token is not valid
```

After migrating to MAS, most things are working, but something I noticed was
- Devices having issues with verification (not sure if related but the only errors I can see are in MAS logs)
- Refresh token appears to be broken (https://matrix-org.github.io/matrix-authentication-service/rustdoc/src/mas_handlers/oauth2/introspection.rs.html) base on the error I got (see logs above), I assume the reason that my OIDC sessions are failing to refresh is due to MAS unable to retrieve a refresh token for various sessions. This issue doesn't seem to affect sessions logged in via upstream provider

**To Reproduce**
Steps to reproduce the behavior:

Not exactly sure sorry.

**Expected behavior**
- Sessions should be able to get refresh tokens
- Device verification should work (might be unrelated)
- MAS shouldn't be spamming above logs

**Screenshots**
If applicable, add screenshots to help explain your problem.

- Synapse 1.127.1
- Mas 0.14.1
- Postgres as database
- Nginx reverse proxy
- Keycloak as upstream provider

### Additional context / edits

- I tried setting the introspection_endpoint in the `homeserver.yaml` to the one produced by keycloak's `.well-known/openid-configuration` but it prevented Synapse from running + spammed about 401/not authed to reach

- I assume both https://github.com/element-hq/matrix-authentication-service/blob/main/crates/storage/src/oauth2/refresh_token.rs and https://github.com/element-hq/matrix-authentication-service/blob/main/crates/storage/src/oauth2/access_token.rs are failing to retrieve the token/store the tokens in postgres?

```
mas=# select * from compat_refresh_tokens
mas-# ;
compat_refresh_token_id | compat_session_id | compat_access_token_id | refresh_token | created_at | consumed_at
-------------------------+-------------------+------------------------+---------------+------------+-------------
(0 rows)
```

Wheras `compat_access_tokens`

```
(3295 rows)
```

doctor output looks good - confirmed that the warnings are false positives (I serve synapse's well-known from a reverse proxy so MAS isn't hitting it.
```
sam@laptop:~/ > k exec -it mas-6c8b8f7d65-nj7dh -- mas-cli doctor
2025-04-03T11:14:43.957532Z INFO cli.doctor: mas_cli::commands::doctor: crates/cli/src/commands/doctor.rs:32: 💡 Running diagnostics, make sure that both MAS and Synapse are running, and that MAS is using the same configuration files as this tool.
2025-04-03T11:14:46.384957Z WARN cli.doctor: mas_cli::commands::doctor: crates/cli/src/commands/doctor.rs:92: ⚠️ Matrix client well-known has an "org.matrix.msc2965.authentication" section, but the issuer is not the same as the homeserver.
Check the well-known document at "https://chat.FOO.well-known/matrix/client"
This can happen because MAS parses the URL its config differently from the homeserver.
This means some OIDC-native clients might not work.
Make sure that the MAS config contains:

http:
public_base: "https://mas.FOO"
# Or, if the issuer is different from the public base:
issuer: "https://mas.FOO"

And in the Synapse config:

experimental_features:
msc3861:
enabled: true
# This must exactly match:
issuer: "https://mas.FOO/"
# ...

See https://element-hq.github.io/matrix-authentication-service/setup/homeserver.html

2025-04-03T11:14:46.395931Z INFO cli.doctor: mas_cli::commands::doctor: crates/cli/src/commands/doctor.rs:194: ✅ Homeserver is reachable at "http://synapse.matrix.svc.cluster.local/_matrix/client/versions"
2025-04-03T11:14:46.457905Z INFO cli.doctor: mas_cli::commands::doctor: crates/cli/src/commands/doctor.rs:247: ✅ Homeserver at "http://synapse.matrix.svc.cluster.local/_matrix/client/v3/account/whoami" is reachable, and it correctly rejected an invalid token.
2025-04-03T11:14:46.459958Z INFO cli.doctor: mas_cli::commands::doctor: crates/cli/src/commands/doctor.rs:292: ✅ The Synapse admin API is reachable at "http://synapse.matrix.svc.cluster.local/_synapse/admin/v1/server_version".
2025-04-03T11:14:46.463553Z INFO cli.doctor: mas_cli::commands::doctor: crates/cli/src/commands/doctor.rs:321: ✅ The Synapse admin API is reachable with authentication at "http://synapse.matrix.svc.cluster.local/_synapse/admin/v1/background_updates/status".
2025-04-03T11:14:46.480425Z INFO cli.doctor: mas_cli::commands::doctor: crates/cli/src/commands/doctor.rs:387: ✅ The legacy login API at "FOO/_matrix/client/v3/login" is reachable and is handled by MAS.

```