Implement automatic OAuth token refresh

Add automatic token refresh to gracefully handle expired access tokens:

Token refresh implementation:
- Add refresh_session() method to TangledClient
- Calls com.atproto.server.refreshSession with refresh token
- Returns new Session with updated access and refresh tokens
- Create util module with session management helpers
- load_session(): Basic session loading
- refresh_session(): Refresh using refresh token and save
- load_session_with_refresh(): Smart loading with auto-refresh

Auto-refresh strategy:
- Check session age on every command invocation
- If session is older than 30 minutes, proactively refresh
- Falls back to old session if refresh fails (might still work)
- Preserves PDS URL and updates created_at timestamp

Update all spindle commands to use auto-refresh:
- Replace SessionManager::load() with util::load_session_with_refresh()
- Applies to: config, list, logs, and all secret operations
- Remove now-unused SessionManager imports

Dependencies:
- Add chrono to tangled-cli for timestamp comparison

Fixes ExpiredToken errors that occurred when access tokens expired
after initial login, requiring manual re-authentication.

Cargo.lock

···
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "chrono",
  "clap",
  "colored",
  "dialoguer",

crates/tangled-api/src/client.rs

···
         })
     }
 
+    pub async fn refresh_session(&self, refresh_jwt: &str) -> Result<Session> {
+        #[derive(Deserialize)]
+        struct Res {
+            #[serde(rename = "accessJwt")]
+            access_jwt: String,
+            #[serde(rename = "refreshJwt")]
+            refresh_jwt: String,
+            did: String,
+            handle: String,
+        }
+        let url = self.xrpc_url("com.atproto.server.refreshSession");
+        let client = reqwest::Client::new();
+        let res = client
+            .post(url)
+            .header(reqwest::header::AUTHORIZATION, format!("Bearer {}", refresh_jwt))
+            .send()
+            .await?;
+        let status = res.status();
+        if !status.is_success() {
+            let body = res.text().await.unwrap_or_default();
+            return Err(anyhow!("{}: {}", status, body));
+        }
+        let res_data: Res = res.json().await?;
+        Ok(Session {
+            access_jwt: res_data.access_jwt,
+            refresh_jwt: res_data.refresh_jwt,
+            did: res_data.did,
+            handle: res_data.handle,
+            ..Default::default()
+        })
+    }
+
     pub async fn list_repos(
         &self,
         user: Option<&str>,

crates/tangled-cli/Cargo.toml

···
 url = { workspace = true }
 tokio-tungstenite = { workspace = true }
 futures-util = { workspace = true }
+chrono = { workspace = true }
 
 # Internal crates
 tangled-config = { path = "../tangled-config" }

crates/tangled-cli/src/commands/spindle.rs

···
 };
 use anyhow::{anyhow, Result};
 use futures_util::StreamExt;
-use tangled_config::session::SessionManager;
 use tokio_tungstenite::{connect_async, tungstenite::Message};
 
 pub async fn run(_cli: &Cli, cmd: SpindleCommand) -> Result<()> {
···
 }
 
 async fn list(args: SpindleListArgs) -> Result<()> {
-    let mgr = SessionManager::default();
-    let session = mgr
-        .load()?
-        .ok_or_else(|| anyhow!("Please login first: tangled auth login"))?;
+    let session = crate::util::load_session_with_refresh().await?;
 
     let pds = session
         .pds
···
 }
 
 async fn config(args: SpindleConfigArgs) -> Result<()> {
-    let mgr = SessionManager::default();
-    let session = mgr
-        .load()?
-        .ok_or_else(|| anyhow!("Please login first: tangled auth login"))?;
+    let session = crate::util::load_session_with_refresh().await?;
 
     if args.enable && args.disable {
         return Err(anyhow!("Cannot use --enable and --disable together"));
···
         (parts[0].to_string(), parts[1].to_string(), parts[2].to_string())
     } else if parts.len() == 1 {
         // Use repo context - need to get repo info
-        let mgr = SessionManager::default();
-        let session = mgr
-            .load()?
-            .ok_or_else(|| anyhow!("Please login first: tangled auth login"))?;
+        let session = crate::util::load_session_with_refresh().await?;
         let pds = session
             .pds
             .clone()
···
 }
 
 async fn secret_list(args: SpindleSecretListArgs) -> Result<()> {
-    let mgr = SessionManager::default();
-    let session = mgr
-        .load()?
-        .ok_or_else(|| anyhow!("Please login first: tangled auth login"))?;
+    let session = crate::util::load_session_with_refresh().await?;
     let pds = session
         .pds
         .clone()
···
 }
 
 async fn secret_add(args: SpindleSecretAddArgs) -> Result<()> {
-    let mgr = SessionManager::default();
-    let session = mgr
-        .load()?
-        .ok_or_else(|| anyhow!("Please login first: tangled auth login"))?;
+    let session = crate::util::load_session_with_refresh().await?;
     let pds = session
         .pds
         .clone()
···
 }
 
 async fn secret_remove(args: SpindleSecretRemoveArgs) -> Result<()> {
-    let mgr = SessionManager::default();
-    let session = mgr
-        .load()?
-        .ok_or_else(|| anyhow!("Please login first: tangled auth login"))?;
+    let session = crate::util::load_session_with_refresh().await?;
     let pds = session
         .pds
         .clone()

crates/tangled-cli/src/main.rs

···
 mod cli;
 mod commands;
+mod util;
 
 use anyhow::Result;
 use clap::Parser;

crates/tangled-cli/src/util.rs

···
+use anyhow::{anyhow, Result};
+use tangled_config::session::{Session, SessionManager};
+
+/// Load session and automatically refresh if expired
+pub async fn load_session() -> Result<Session> {
+    let mgr = SessionManager::default();
+    let session = mgr
+        .load()?
+        .ok_or_else(|| anyhow!("Please login first: tangled auth login"))?;
+
+    Ok(session)
+}
+
+/// Refresh the session using the refresh token
+pub async fn refresh_session(session: &Session) -> Result<Session> {
+    let pds = session
+        .pds
+        .clone()
+        .unwrap_or_else(|| "https://bsky.social".to_string());
+
+    let client = tangled_api::TangledClient::new(&pds);
+    let mut new_session = client.refresh_session(&session.refresh_jwt).await?;
+
+    // Preserve PDS from old session
+    new_session.pds = session.pds.clone();
+
+    // Save the refreshed session
+    let mgr = SessionManager::default();
+    mgr.save(&new_session)?;
+
+    Ok(new_session)
+}
+
+/// Load session with automatic refresh on ExpiredToken
+pub async fn load_session_with_refresh() -> Result<Session> {
+    let session = load_session().await?;
+
+    // Check if session is older than 30 minutes - if so, proactively refresh
+    let age = chrono::Utc::now()
+        .signed_duration_since(session.created_at)
+        .num_minutes();
+
+    if age > 30 {
+        // Session is old, proactively refresh
+        match refresh_session(&session).await {
+            Ok(new_session) => return Ok(new_session),
+            Err(_) => {
+                // If refresh fails, try with the old session anyway
+                // It might still work
+            }
+        }
+    }
+
+    Ok(session)
+}