Holds Cognito tokens; refreshes via /auth/refresh and persists the result.
Drop cached state and obtain a fresh token (after an unexpected 401).
Returns a valid bearer token, refreshing if expired.
Holds Cognito tokens; refreshes via /auth/refresh and persists the result.