fix(connect): catch authlib OAuthError in background token refresh thread

[Solaris-star]

Summary

Fixes #2110

The periodic_refresh_token daemon thread only caught httpx.HTTPError. When the identity provider rejects a refresh at the OAuth2 protocol level (e.g. Keycloak returns 400 invalid_grant due to token rotation, reuse, revocation, or session expiry), authlib raises OAuthError which inherits from AuthlibBaseError — NOT from httpx.HTTPError. The uncaught exception killed the daemon thread silently, permanently breaking the connection's ability to refresh tokens.

Fix

Add AuthlibBaseError to the except clause so both transport-level (HTTPError) and protocol-level (OAuthError) failures are caught, warned, and retried after 1 second:

# Before
except HTTPError as exc:
# After
except (HTTPError, AuthlibBaseError) as exc:

Tests

Added test/test_token_refresh.py with 4 tests:

• test_authlib_base_error_is_not_http_error — confirms AuthlibBaseError is NOT a subclass of HTTPError (proves the bug exists)
• test_authlib_base_error_caught_by_fixed_except_clause — the fixed clause catches it
• test_http_error_still_caught_by_fixed_except_clause — no regression on existing behavior
• test_oauth_error_subclass_caught — concrete OAuthError subclass is also caught

$ pytest test/test_token_refresh.py -v
4 passed

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[weaviate-git-bot]

To avoid any confusion in the future about your contribution to Weaviate, we work with a Contributor License Agreement. If you agree, you can simply add a comment to this PR that you agree with the CLA so that we can merge.

beep boop - the Weaviate bot 👋🤖

PS:
Are you already a member of the Weaviate Forum?

[Solaris-star]

I have read and agree to the Contributor License Agreement.