refactor(auth): split refresh-token error classification per platform