feat(integrations): add one token lifecycle for every OAuth provider

A provider describes where its grant lives and how its token endpoint is
called; the kit reads the grant, refreshes it under the per-user advisory
lock, re-reads under the lock so a peer's refresh or a reconnect wins, and
writes back only over the refresh token it spent. Retry-After is read in
one place, both forms, with a cap.

src/lib/integrations/oauth-refresh.ts

@@ -62,7 +62,14 @@ export async function persistRotatedToken(
 }
 
 export type SerializedRefreshProvider =
-  "whoop" | "withings" | "oura" | "codex" | "admin-codex";
+  | "whoop"
+  | "withings"
+  | "oura"
+  | "strava"
+  | "google-health"
+  | "polar"
+  | "codex"
+  | "admin-codex";
 
 /**
  * Provider refreshes hold a database transaction open around one bounded