fix(profiles): refresh selected profile credentials

[isac322]

Summary

• Route proactive, reactive, manual, and background OAuth refresh through the selected Claude Max profile's credential store instead of always using the default Claude store.
• Scope in-flight OAuth refresh deduplication by credential store so separate profiles refresh independently while duplicate refreshes for the same store still coalesce.
• Add regression coverage for /auth/refresh with x-meridian-profile to prove only the requested profile credentials are updated.

Tests

• bun test src/__tests__/profile-token-refresh-route.test.ts src/__tests__/token-refresh.test.ts src/__tests__/token-refresh-profile.test.ts
• bun run typecheck

Closes #499