refactor: OAuth token response may have optional refresh token.

crates/atproto-oauth-aip/src/lib.rs

···
 //! let session = session_exchange(
 //!     &http_client,
 //!     &protected_resource.resource,
-//!     &token_response.access_token,
-//!     &None
+//!     &token_response.access_token
 //! ).await?;
 //! # Ok(())
 //! # }

crates/atproto-oauth-aip/src/workflow.rs

···
 //! let session = session_exchange(
 //!     &http_client,
 //!     &protected_resource.resource,
-//!     &token_response.access_token,
-//!     &None
+//!     &token_response.access_token
 //! ).await?;
 //! # Ok(())
 //! # }

crates/atproto-oauth-axum/src/bin/atproto-oauth-tool.rs

···
     println!("\nOAuth Token Refresh Response:");
     println!("Access Token: {}", token_response.access_token);
     println!("Token Type: {}", token_response.token_type);
-    println!("Refresh Token: {}", &token_response.refresh_token);
+    println!(
+        "Refresh Token: {}",
+        token_response.refresh_token.as_deref().unwrap_or("N/A")
+    );
     println!("Scope: {}", token_response.scope);
     println!("Expires In: {} seconds", token_response.expires_in);
     println!(

crates/atproto-oauth-axum/src/handle_complete.rs

···
         document.id,
         oauth_request.issuer,
         token_response.access_token,
-        token_response.refresh_token,
+        token_response
+            .refresh_token
+            .clone()
+            .unwrap_or_else(|| "N/A".to_string()),
         token_response.token_type,
         token_response.expires_in,
         token_response.scope,

crates/atproto-oauth/src/workflow.rs

···
     pub token_type: String,
 
     /// The refresh token that can be used to obtain new access tokens.
-    pub refresh_token: String,
+    /// Not all token responses include a refresh token.
+    pub refresh_token: Option<String>,
 
     /// The scope of access granted by the access token.
     #[cfg_attr(feature = "zeroize", zeroize(skip))]