feat: add e2b-box auth refresh

[OndrejDrapalik]

Summary

• New e2b-box auth refresh [ID] [--json]: one row per connection and discovered session, with status, time left, and the command to run when a row is stale. Bare refresh covers everything; an ID narrows it.
• Rotates only what the plugin owns: a codex --oauth connection (ADR 0015), once its bearer is inside its last 5 days or expired. Borrowed codex sessions (ADR 0010), claude setup-tokens and muse/amp keys are report-only. No running box is touched.
• Claude setup-tokens show expiring inside their last 30 days, since they have no refresh half.
• Exits 1 when a row would leave a new box unauthenticated (expired/unavailable), so it is safe to cron.
• Wired into bin/e2b-box and auth --help; README paragraph.

Out of scope, tracked separately: rotating grok's multi-use grant, and --push delivery into running boxes.

Known issue (predates this PR)

After a rotation, auth list still shows the connection as expired: rewriteOauthSecret rewrites the token file but not expiresAt in the metadata, and auth list reads the metadata. auth reconnect has the same gap. auth refresh and auth check read the token and are correct.

Test plan

• node --test test/auth-refresh.test.js (4 tests, including a CLI spawn)
• Live run on a real config: 6 rows, one expired codex --oauth chain rotated to 9 days, exit 0; auth check codex-personal confirms locally-ready
• e2b-box auth refresh --json and e2b-box auth refresh <id> on your own config