Logs in lazily on first use, then behaves like a TokenCredential.
Drop cached state and obtain a fresh token (after an unexpected 401).
Returns a valid bearer token, refreshing if expired.
Logs in lazily on first use, then behaves like a TokenCredential.