fix(guard): harden Bitbucket OAuth callback on bad expires_at + redact refresh-error logs