hyper: persist rotated refresh tokens and read credentials in either auth.json shape