Under the hood: refresh-token rotation with replay detection, instant revocation, and scoped permissions with risk levels (reading a calendar shouldn't look like charging a card). It's v0.1.0 and…