Holds the OAuth 2.0 token state for one client: refreshes before expiry, resolves the cloud id once, and reports
rotated refresh tokens through onTokenRefresh.
Both the refresh and the cloud-id lookup are single-flighted, so N concurrent requests hitting an expired token
produce one token call, not N.
Holds the OAuth 2.0 token state for one client: refreshes before expiry, resolves the cloud id once, and reports rotated refresh tokens through
onTokenRefresh.Both the refresh and the cloud-id lookup are single-flighted, so N concurrent requests hitting an expired token produce one token call, not N.