[Bug] Trigger OAuth credential refresh runs every minute when token TTL equals the 1h threshold

### Self Checks

- [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
- [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).
- [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
- [x] I confirm that I am using English to submit this report, otherwise it will be closed.
- [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
- [x] Please do not modify this template :) and fill in all the required fields.

### Dify version

main (1.17.x)

### Cloud or Self Hosted

Self Hosted (Docker)

### Steps to reproduce

1. Create an OAuth2 plugin trigger subscription whose access token lifetime is about 1 hour (common for Gmail / many OAuth providers).
2. Ensure `ENABLE_TRIGGER_PROVIDER_REFRESH_TASK=true` (default) and leave `TRIGGER_PROVIDER_CREDENTIAL_THRESHOLD_SECONDS` at the default `3600`.
3. Watch worker logs for `Refreshing OAuth token`.

### ✔️ Expected Behavior

Credentials are refreshed only when they are approaching expiry (within the proactive threshold), not on every poll tick for the entire token lifetime.

### ❌ Actual Behavior

The poller runs every `TRIGGER_PROVIDER_REFRESH_INTERVAL` minute (default 1). A subscription is due when:

```python
credential_expires_at <= now + TRIGGER_PROVIDER_CREDENTIAL_THRESHOLD_SECONDS
```

With default threshold `3600` and a freshly refreshed 1h token (`expires_at ≈ now + 3600`), the inequality is immediately true again. The executor refreshes OAuth every minute for the whole hour.

This is independent of #41162 (`expires_at=-1` on the *subscription* lease). That bug prevents subscription renewal; this one causes OAuth credential spam when the lease path works.

### Suggested fix

Lower the default `TRIGGER_PROVIDER_CREDENTIAL_THRESHOLD_SECONDS` (and likely the subscription threshold) to a value meaningfully smaller than typical OAuth TTLs (e.g. 300–600s), and add a unit test that a credential with `expires_at = now + 3600` is **not** due under the new default.

No file or test path is named. Start with the trigger provider refresh poller, OAuth credential due check, and the default threshold configuration; verify how the executor decides a credential is due. Done means choosing a smaller default threshold and adding a unit test showing a token with expires_at = now + 3600 is not due under that default.

Written by the indexing model from the issue text.