feat(auth): support short-lived impersonated sessions

[tatoalo]

Problem

PostHog intentionally issues impersonated OAuth sessions without refresh tokens so they cannot outlive the browser impersonation session. PostHog Code previously required a refresh token and failed while creating the local session.

Staff need to use PostHog Code as an impersonated user when investigating user-specific behavior without turning that short-lived authorization into a persistent login.

Changes

Support refresh-less OAuth responses as short-lived impersonated sessions. The access token remains in memory, works for API and agent proxy requests, and is never written to the persistent auth store.

Impersonated sessions remain active through permission-denied responses, then sign out at the exact token expiry, on token rejection, when the app restarts, or when a refresh is requested. The project switcher shows when the session ends, and the sign-in screen explains how to continue after expiry.

Normal OAuth refreshes retain the existing refresh token when the server does not rotate it. Impersonated credentials are not exported to the process environment.

[trunk-io]

😎 Merged directly without going through the merge queue, as the queue was empty and the PR was up to date with the target branch - details.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 12612e9.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "feat(auth): support short-lived imperson..." | Re-trigger Greptile}