Auth: linking sends the cached ID token without refreshing an expired one #80

From the Copilot review of #73 (#73 (comment)), on the account linking from #69 by @TomislavMladenov.

linkWithCredential passes signedInUser.idToken to the link request without checking its lifetime. After an idle period, or when a restored session's token has expired while its refresh token is still valid, both OAuth and phone linking fail with TOKEN_EXPIRED unless the caller refreshes manually first.

Suggested fix: chain the link request from getAccessToken(false), propagate a refresh failure, and send the resulting token.