Retain id_token and refresh_token across token refreshes

[petrikero]

Problem

refreshTokenSet saved the refresh_token grant response verbatim as the new session token set. But an OAuth2/OIDC refresh response is a delta, not a full replacement:

• Ory/Hydra does not return a new id_token on a refresh, so the stored id_token was wiped on the first refresh.
• A server with refresh-token rotation disabled may omit refresh_token from the response, which would drop it and silently sign the user out.

Losing the id_token is the more visible symptom: the CLI can no longer read the user's identity claims (sub/email/name) locally and is forced onto a UserInfo endpoint for every auth whoami / get kubeconfig call.

Fix

Add mergeRefreshedTokenSet, which treats the refresh response as a delta over the previous token set: access_token always comes from the response, while id_token and refresh_token are carried forward from the previous set whenever the response omits them.

Tests

First unit tests for pkg/auth:

• TestMergeRefreshedTokenSet — all-fields, omitted id_token (Ory behavior), omitted refresh_token (rotation disabled), and access-token-only responses.

Notes

Independent correctness fix with no behavior change when the server returns all fields. A separate follow-up will use the now-retained id_token to resolve user info from claims and remove the dependency on the sunsetting portal /api/external/userinfo endpoint.