refreshMarginMs (mcp-oauth/token-service.ts)

* `McpProviderTokenService` — the CP's custody of one provider's upstream OAuth grant (docs/designs/mcp-provider-oauth.md). The `LinearTokenService` shape, because the hazard is identical: an access token expires, refreshing it MAY rotate the refresh token, and a rotated refresh

// Source: https://github.com/agentconnect-md/agentconnect | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * `McpProviderTokenService` — the CP's custody of one provider's upstream OAuth grant
 * (docs/designs/mcp-provider-oauth.md).
 *
 * The `LinearTokenService` shape, because the hazard is identical: an access token expires,
 * refreshing it MAY rotate the refresh token, and a rotated refresh token spent twice leaves
 * the organization holding a credential the authorization server has already invalidated.
 *
 * THREE properties, all load-bearing:
 *
 *  - SINGLE-FLIGHT per provider. N concurrent callers wanting a fresh token must produce ONE
 *    upstream refresh; every 

... (truncated -- full source via MCP)