3p OAuth tokens are used by the user-graph

When creating the user-graph, we don't distinguish if the oauth token received was for graph or some other service. We currently use whatever token is issued and put it in the graph client, but this may not always be a graph token.

Start at the user-graph creation path and the graph client setup described in the issue. Trace how OAuth tokens are received and passed to the graph client, then define completion as ensuring that only an appropriate graph token is used; no specific files or tests are named, so locate relevant coverage before changing behavior.

Written by the indexing model from the issue text.