tokenRefreshStrategy
Strategy used to refresh session token.
Disabled by default; expired ID-token sessions are rejected on user routes. Expiry and refresh timing use OidcToken.Id.claims; when the ID token has no exp claim, sessions are never treated as expired and auto-refresh never triggers.