Automatic MCP Server Token Refresh

### Describe the bug

# Automatic MCP Server Token Refresh

## Problem

When using long-running autopilot workflows (e.g., multi-PR feature development via custom agents), MCP server OAuth tokens expire mid-workflow. This causes:

1. **Silent tool failures** — MCP tool calls return `AADSTS9010010` auth errors
2. **Workflow interruption** — the agent must stop and ask the user to manually run `/mcp reload`
3. **Lost autopilot momentum** — what should be a hands-off workflow becomes a babysitting exercise

### Real-world impact

During a unit test coverage feature delivered via a custom agent plugin (4 PRs, 258 tests), MCP auth expired multiple times. Each time:

- The agent retried 3× with 10s delays (workaround we built into the plugin)
- After 3 failures, it had to pause and ask the user to run `/mcp reload`
- The user had to switch context, reload, then tell the agent to continue
- Total disruption: ~2-5 minutes per occurrence, multiple occurrences per session

This completely undermines the value proposition of autopilot mode.

## Proposed Solution

**Proactive token refresh**: The CLI should detect when an MCP server's OAuth token is approaching expiry and refresh it automatically in the background, similar to how `az login` maintains a token cache with automatic refresh.

### Implementation suggestions

- Use the OAuth refresh token (if available) to obtain a new access token before expiry
- If using device code flow, detect the approaching expiry window (e.g., 5 minutes before) and initiate re-auth proactively
- Surface a non-blocking notification: "🔄 Refreshed MCP auth for [server-name]"
- If silent refresh is impossible (no refresh token), fall back to prompting — but only once, not on every tool call

## Environment

- Copilot CLI on Windows (PowerShell)
- MCP servers using Entra ID (Azure AD) OAuth
- Token lifetime: typically 1 hour
- Workflows: 2-6+ hours in autopilot mode

## Current Workaround

We built an "MCP Auth Recovery Gate" pattern into our plugin, but this requires manual intervention.

```text
Retry 3× with 10s delay → if all fail with AADSTS error → ask user to run /mcp reload
```

This works but defeats autopilot's purpose.

### Affected version

_No response_

### Steps to reproduce the behavior

_No response_

### Expected behavior

_No response_

### Additional context

_No response_

Start by tracing the MCP authentication lifecycle and the `/mcp reload` path, focusing on how OAuth access and refresh tokens are handled for Entra ID servers. Define the expiry window and background refresh behavior, then verify that silent refresh is non-blocking and that servers without refresh tokens prompt only once.

Written by the indexing model from the issue text.