fix: return rotated refresh token from agent token refresh endpoint

Previously the refresh endpoint only returned a new accessToken, causing
agents to lose their refreshToken after the first refresh cycle and
forcing a full re-registration every ~2 hours.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/openapi.json

@@ -2913,14 +2913,18 @@
       },
       "AgentRefreshResponse": {
         "type": "object",
-        "description": "Refreshed access token",
+        "description": "Refreshed access and refresh tokens",
         "properties": {
           "accessToken": {
             "type": "string"
+          },
+          "refreshToken": {
+            "type": "string"
           }
         },
         "required": [
-          "accessToken"
+          "accessToken",
+          "refreshToken"
         ]
       },
       "CommandRequest": {